# Browser History / Visited Link Theft

> Detects CSS-based browser history sniffing patterns and sensitive data in browser history.

- Skill: `zakirkun/browser-history-visited-link-theft` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/browser-history-visited-link-theft`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/browser-history-visited-link-theft/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/browser-history-visited-link-theft

---


# Browser History Theft

## Overview
CSS-based history theft uses `:visited` pseudo-class timing differences to detect which URLs a user has visited. While modern browsers have mitigated this, JavaScript APIs can still expose visited URLs through timing channels or getComputedStyle attacks. Additionally, sensitive data in URLs persists in browser history.

## Remediation
- Avoid putting sensitive data in URLs
- Use `window.history.replaceState()` to remove sensitive parameters after processing
- Set `Cache-Control: no-store` for pages with sensitive URL parameters