In the browser channel the 3DS Requestor initiates with the 3DS Server, the browser invokes the 3DS Method to the ACS where a 3DS Method URL is cached for the card range over a server-authenticated TLS session that the ACS ends processing without (Req 3.85), the 3DS Server ensures the browser-to-requestor session is server-authenticated TLS and gathers the AReq information (Req 3.86), and then follows the same routing, decision, relay and results steps as the app flow (Req 3.87 onward) with the challenge delivered in an iframe: the 3DS Server passes the ACS URL and CReq data to the browser, the ACS renders the challenge window, the cardholder responds, and the ACS posts the final CRes to the 3DS Requestor's notification URL; browser and device information replaces SDK device data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.