A data processing system, comprising: a processor; a memory, coupled to the processor, storing instructions that when executed by the processor, cause the processor to: receive, from a user device executing a browser application, a request for a web application content, transmit to the user device, after receiving the request for the web application content, a corresponding web application content data and content source rules, the content source rules including a web application user identifier, ID, receive from the browser application a rule violation report, associated with the content source rules, and including an indication of the web application user ID, analyze the rule violation report to determine presence of a malicious modification of the browser application, and transmit, based at least in part on a result of analyzing the rule violation report, a user alert to a user device associated with the web application user ID, indicating determined presence of a malicious modification of the browser application; wherein the memory further stores instructions that when executed by the processor, cause the processor to: receive from the application a log-in identifier, ID, that is unique to the user of the web application, and base the web application user ID, at least in part, on the log-in ID; maintain a login instance record, configured to store information identifying another user device from which the user associated with the web application ID has sent the log-in ID to the web application; and transmit, in association with transmitting the user alert to the user device, a malicious modification alert to the another user device, the malicious modification alert configured to indicate a risk that at least one application associated with the another user device has a risk of a related malicious modification. a processor; a memory, coupled to the processor, storing instructions that when executed by the processor, cause the processor to: receive, from a user device executing a browser application, a request for a web application content, transmit to the user device, after receiving the request for the web application content, a corresponding web application content data and content source rules, the content source rules including a web application user identifier, ID, receive from the browser application a rule violation report, associated with the content source rules, and including an indication of the web application user ID, analyze the rule violation report to determine presence of a malicious modification of the browser application, and transmit, based at least in part on a result of analyzing the rule violation report, a user alert to a user device associated with the web application user ID, indicating determined presence of a malicious modification of the browser application; receive, from a user device executing a browser application, a request for a web application content, transmit to the user device, after receiving the request for the web application content, a corresponding web application content data and content source rules, the content source rules including a web application user identifier, ID, receive from the browser application a rule violation report, associated with the content source rules, and including an indication of the web application user ID, analyze the rule violation report to determine presence of a malicious modification of the browser application, and transmit, based at least in part on a result of analyzing the rule violation report, a user alert to a user device associated with the web application user ID, indicating determined presence of a malicious modification of the browser application; wherein the memory further stores instructions that when executed by the processor, cause the processor to: receive from the application a log-in identifier, ID, that is unique to the user of the web application, and base the web application user ID, at least in part, on the log-in ID; maintain a login instance record, configured to store information identifying another user device from which the user associated with the web application ID has sent the log-in ID to the web application; and transmit, in association with transmitting the user alert to the user device, a malicious modification alert to the another user device, the malicious modification alert configured to indicate a risk that at least one application associated with the another user device has a risk of a related malicious modification. receive from the application a log-in identifier, ID, that is unique to the user of the web application, and base the web application user ID, at least in part, on the log-in ID; maintain a login instance record, configured to store information identifying another user device from which the user associated with the web application ID has sent the log-in ID to the web application; and transmit, in association with transmitting the user alert to the user device, a malicious modification alert to the another user device, the malicious modification alert configured to indicate a risk that at least one application associated with the another user device has a risk of a related malicious modification.