zakirkun Browser History Theft
Overview
CSS-based history theft uses :visited pseudo-class timing differences to detect which URLs a user has visited. While modern browsers have mitigated this, JavaScript APIs can still expose visited URLs through timing channels or getComputedStyle attacks. Additionally, sensitive data in URLs persists in browser history.
Remediation
- Avoid putting sensitive data in URLs
- Use
window.history.replaceState()to remove sensitive parameters after processing - Set
Cache-Control: no-storefor pages with sensitive URL parameters