Palo Alto Networks Acknowledges Limitations of SWGs Against Last Mile Reassembly Attacks

Palo Alto Networks, based in California, acknowledged the limitations of Secure Web Gateways (SWGs) in a recent press release dated September 4, 2025. This recognition follows the disclosure of Last Mile Reassembly attacks by SquareX at DEF CON 32 in 2024, where over 20 techniques were identified that enable attackers to bypass major SASE/SSE solutions and smuggle malware through browsers. Despite responsible disclosures to SASE/SSE providers, no vendor had warned customers about these vulnerabilities until now.

The Last Mile Reassembly attacks exploit architectural flaws in SWGs, allowing attackers to break malware into chunks that evade detection. Once these chunks pass through the proxy inspection, they are reassembled in the victim’s browser. Attackers also utilize unmonitored channels like WebRTC, gRPC, and WebSockets to smuggle malicious files, which many SWGs recommend disabling.

SquareX’s research has revealed that these attacks can also lead to Data Splicing Attacks, where sensitive data is exfiltrated using similar techniques. At BSides San Francisco in 2025, SquareX demonstrated how insider threats could leverage these methods to bypass endpoint Data Loss Prevention (DLP) solutions.

The emergence of browser-based attacks underscores the necessity for enhanced security measures. SquareX has initiated a research project, The Year of Browser Bugs, which aims to disclose significant vulnerabilities monthly. This initiative highlights the growing importance of browser security as a primary access point for cyber threats.

Vivek Ramachandran, the founder of SquareX, emphasized that proactive research is essential for defending against advanced attacks. The collaboration with major enterprises to produce The Browser Security Field Manual aims to educate cybersecurity practitioners on emerging threats and mitigation strategies.

Implications for Cybersecurity

The acknowledgment from Palo Alto Networks signifies a shift in the cybersecurity landscape, where traditional proxy solutions are deemed inadequate against evolving threats. Organizations should recognize that the browser is becoming a critical attack vector and prioritize browser-native security solutions.

As Last Mile Reassembly attacks become more prevalent, organizations must evaluate their current security measures and consider integrating solutions that address browser vulnerabilities. This includes monitoring unmonitored communication channels and ensuring that DLP solutions are equipped to handle browser-based threats.

In light of these developments, cybersecurity professionals should stay informed about the latest research and emerging threats, adapting their strategies to protect against sophisticated attacks that exploit browser weaknesses.