Attackers Can Use QR Codes to Bypass Browser Isolation

Mandiant researchers published a proof-of-concept showing attackers can bypass remote/on-premises/local browser isolation by returning pages that render machine-readable QR codes; a local implant running a headless browser screenshots and decodes the QR to receive C2 commands and exfiltrate output via URL parameters. The report details the attack sequence, technical constraints (QR data-size limits, multi-second latency, and unaddressed isolation controls like domain reputation or DLP), and recommends continuing to use browser isolation alongside monitoring and automated browser protections.