The increasing complexity and interconnectivity of web applications have made them prime targets for cyber threats. Social engineering attacks exploit human psychology to deceive users, while code injection attacks leverage technical vulnerabilities to execute malicious code. The convergence of these two attack vectors has led to a rise in hybrid threats that simultaneously exploit both technical weaknesses and user trust. Despite advancements in security mechanisms, existing defenses often focus solely on either technical hardening or user education, leaving a critical gap in mitigating hybrid threats. This thesis addresses this challenge by proposing a multi-layered defense strategy aimed at reducing the attack surface for web application users through customized browser engines and security frameworks. To achieve this, we introduce three key technologies: TRIDENT, SAFECODE, and COINDX. TRIDENT detects and blocks large-scale social engineering attacks propagated through low-tier ad networks by analyzing the behaviors of ad scripts. SAFECODE secures Electron applications against code injection by enforcing execution policies that validate code integrity at the structural and contextual levels. COINDX conducts root cause analysis of code injection attacks in JavaScript applications, aiding developers in vulnerability remediation through iterative symbolic analysis. Together, these solutions significantly reduce the attack surface by proactively preventing, detecting, and analyzing hybrid cyber threats. This research contributes to bridging the gap between psychological and technical exploit mitigation, offering a comprehensive security approach for the modern web ecosystem.