analyzing-browser-forensics-with-hindsight

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text from the user’s browser profile databases (e.g., History/Downloads/Cookies/manifest.json contents) is read at runtime from local SQLite/JSON files and then serialized into the agent’s output/printed context, which can be fed into the LLM by the surrounding system; this is not user-authored and is effectively arbitrary web content (URLs/titles) originating from other parties.