Various examples are directed to systems and methods for securing a web browser. The web browser may parse web content received from a server and identify a script associated with the web content. The web browser may generate script fingerprint data for the script. The script fingerprint data may comprise script code data describing script code for the script and script syntax data describing the script. The web browser may determine that the script fingerprint data is not described by local known script data and may send an anomalous script report to the server, where the anomalous script report comprising the script fingerprint data. The web browser may also update the local known script data to describe the script fingerprint data.