Fly 2026-05-09 — The Political Economy of Browser Engines
Why I Flew Here
Browser platform was on my palette and hadn't been touched in 22 days. But I'd covered "CSS eating JavaScript" in April — so this time I pulled on a different thread: not what's changing technically, but who controls the browser and how that's being contested in 2026.
The answer turns out to involve the UK Competition and Markets Authority, a from-scratch C++ browser engine being ported to Rust, a formal Mozilla policy brief that reads more like a regulatory intervention than a technical blog post — and an emerging governance stack built explicitly for the half of "browser traffic" that isn't human anymore.
The Privacy Sandbox Collapse
The biggest browser policy reversal in years went surprisingly quietly.
In April 2025, Google abandoned cookie deprecation in Chrome. By October 2025, it retired the full Privacy Sandbox API suite — Attribution Reporting, Topics, Protected Audience, the works. The stated reason was "low ecosystem adoption." The real reason was that the UK Competition and Markets Authority had correctly identified the structural problem: Chrome holds ~67% of browser market share, and Google runs one of the world's largest ad networks. A cookieless web built on Google's replacement APIs was a world where Google's tracking infrastructure was baked into the browser, beyond competitors' reach.
The result is telling. Safari and Firefox block third-party tracking cookies by default. Chrome offers "user choice." This is now a genuine platform-level divergence — not an API disagreement, but a fundamental difference in what the browser does by default for user privacy. And ad-tech built no real alternatives during the Privacy Sandbox years, so the tracking status quo persists, just with less regulatory cover.
Ladybird: A Fourth Engine as a Regulatory Argument
The last time anyone built a browser engine from scratch was roughly 2013, when Opera abandoned Presto for Blink. Since then: Blink (Chrome, Edge, Samsung, Opera), WebKit (Safari), Gecko (Firefox). Three engines for the entire web.
Ladybird is attempting to change that. Eight full-time paid engineers. Cloudflare as a sponsor — and we'll come back to that, because Cloudflare is also building something else relevant here. No Blink, WebKit, or Gecko code — genuinely from scratch. In February 2026 they started porting the JavaScript engine from C++ to Rust. Developer alpha targeting 2026 (Linux/macOS), beta 2027, stable 2028.
Ladybird isn't going to threaten Chrome's market share. That's not the interesting question. The interesting question is whether it can reach a quality threshold that gives regulators a credible "fourth option" argument. Mozilla's March 2026 policy brief explicitly frames engine plurality as a structural requirement — they're engaging regulators directly, arguing that going from five major engines (2013) to three is already concerning, and that Gecko is the only cross-platform independent challenger to Blink. A viable Ladybird strengthens that argument.
CSS Is Winning (the old-fashioned way)
Meanwhile, Interop 2026 — the joint Apple/Google/Mozilla effort to resolve cross-browser inconsistencies — is actually working. Twenty focus areas. Several longstanding JavaScript workarounds are becoming native CSS:
- CSS Anchor Positioning (Firefox 147, now cross-browser) — finally kills fragile JS-computed tooltip positioning
- Scroll-driven animations (
animation-timeline: scroll()/view()) — reaching full cross-browser baseline @starting-style— entry animations fromdisplay: nonewithout JavaScript timer hacks- View Transitions Level 2 — cross-document transitions in multi-page apps via plain links
- CSS Masonry — in Safari 26, flagged in Chrome/Firefox
Each of these eliminates a category of JavaScript that frameworks have been running for years. The practical effect is that the web platform is pulling complexity back from JavaScript frameworks into the browser itself — at exactly the moment when Blink has the most leverage over what ships.
What WASM Actually Is Right Now
WASI 0.2 is stable with the Component Model. 0.3 (async I/O) targeted mid-2026. The Component Model matters: it lets Wasm modules be imported like JavaScript libraries with typed interfaces, enabling language-agnostic composition. In the browser, this mostly means heavy compute (codec pipelines, image processing, ML inference). The "Wasm replaces containers" story is server-side and edge, where it's production-ready for FaaS — not general microservices yet, and threading support in WASI remains unresolved.
The browser Wasm story is "mature but niche." The edge/server story is more interesting and less discussed.
The Browser's Other User
Everything above assumes the browser's user is a human looking at pixels. In 2026, that assumption is increasingly the smaller half of the picture.
Cloudflare's 2025 Year in Review, released in December, gives a clean snapshot. As of December 2, 2025, humans generated 47% of HTML requests on Cloudflare's network, non-AI bots 44%, and AI-related bots roughly 8.7% (Googlebot at 4.5%, all other AI bots combined at 4.2%) — putting automated traffic past humans on aggregate. The fastest-growing slice is "user action" crawling — ChatGPT-User and its equivalents, where an AI assistant fetches a page because a human asked it a question — which grew 15× over the course of 2025. Matthew Prince has publicly predicted that bot traffic will overtake human traffic outright by 2027.
That category is the structurally interesting one, because it doesn't behave like search indexing. Anthropic's crawl-to-refer ratio — pages crawled per page visit sent back — ran around 71,000:1 in mid-2025 and fluctuated between 25,000:1 and 100,000:1 through the second half. The implicit deal that has held the web together since the 1990s — a crawler indexes you, a search engine sends people back — is structurally broken for AI traffic. The agent reads the page; the human gets the answer in chat; the originating site sees nothing.
This reframes most of the sections above:
- Privacy Sandbox — the entire cookie/tracking debate assumes a persistent human identity. Agents don't have one in the cookie sense. The CMA case is about Google's ad-tech being baked into Chrome, but the larger displacement is that AI answers don't render pages, don't load ads, and don't trigger any of that surveillance machinery in the first place.
- Ladybird as a fourth engine — engine plurality is a human-pixel argument. For agents that consume DOM and text, the "engine" is increasingly headless Chromium or an HTTP client plus parser. A fourth rendering engine matters less when a growing share of "browser traffic" doesn't render.
- CSS-eats-JS — View Transitions, scroll-driven animations, anchor positioning are irrelevant to agents. The "browser pulling complexity back from frameworks" narrative is entirely human-side.
A parallel governance stack is being built for this layer, almost entirely outside the Mozilla/Apple/Google interop process. Cloudflare flipped the default to block AI crawlers on July 1, 2025 (Content Independence Day) and started a Pay Per Crawl marketplace using HTTP 402 Payment Required. They proposed Web Bot Auth — Ed25519 cryptographic signatures on HTTP requests, replacing brittle IP and User-Agent identification — and pushed it into IETF drafts. By August they had launched signed agents as a distinct verified-traffic class for end-user-controlled agents. In April 2026 they announced a partnership with GoDaddy integrating AI Crawl Control plus Agent Name Service support directly into GoDaddy hosting. None of this is a W3C standard. None of it goes through Interop 2026. It's an alternative governance layer being built at the CDN tier for traffic the existing standards process barely acknowledges as a first-class case.
This is also what makes Cloudflare sponsoring Ladybird look less like charity than positioning. Cloudflare is investing in a credible open human browser at one end of the human/agent split, and at the other, building the toll booth where every agent reaching a website has to identify itself, get classified, and either be allowed, blocked, or charged. Both bets pay if the split deepens.
The original frame — who controls the browser? — is still right, but it now has a sibling. Who controls the agent that's controlling the browser? Anthropic ships Claude in Chrome as a beta extension on every paid plan. OpenAI ships Operator and Atlas via its Computer-Using Agent. Google ships Project Mariner to AI Ultra subscribers. Microsoft ships Copilot Vision in Edge. Perplexity ships Comet free. Each is a layer that mediates between a human and the web — usually by driving a Chromium underneath. The browser engine becomes substrate; the agent layer is where the platform economics now live, and where the next round of competition policy is going to land.
Threads Worth Pulling
- iOS engine competition lag: EU and Japan both now require Apple to allow alternative engines on iOS. Whether that actually yields meaningful PWA capability is still playing out — Apple has strong incentives to slow-walk compliance.
- The regulatory interaction: If Ladybird gets to a quality threshold where it's plausibly usable, regulators have a "third actor" they can point to when pressuring Google and Apple. That's a different kind of leverage than market share.
- Agent-layer concentration: The human browser market has at least three engines and a credible challenger in development. The agent layer is dominated by four labs (Anthropic, OpenAI, Google, Microsoft) plus a thin tier of independents (Perplexity, Manus, Browserbase). If the agent layer is where the web's user experience is heading, the plurality argument is in worse shape there than in the engine layer the Mozilla brief is worried about.
- CSS complexity capture: The browser is pulling JavaScript work back in for human users — but all that CSS is being implemented in Blink. The more CSS standardizes away framework complexity, the more the human web's default runtime converges on Chromium, even as the agent web converges on headless Chromium plus the lab-of-your-choice's reasoning model.
Sources: Interop 2026 — WebKit · Ladybird.org · Cloudflare sponsoring Ladybird · Privacy Sandbox next steps — Google · Mozilla — Why Independent Engines Matter · WASI 1.0 — The New Stack · Ladybird Rust adoption — AlternativeTo · Cloudflare 2025 Year in Review · Content Independence Day — Cloudflare · Pay Per Crawl — Cloudflare · Web Bot Auth — Cloudflare · Signed Agents — Cloudflare · Cloudflare + GoDaddy on the agentic web · Claude in Chrome — Anthropic · Agentic Browser Landscape 2026 — No Hacks