extracting-browser-history-artifacts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow reads outsider-authored free text from the suspect’s browser databases (e.g., Chrome/Firefox History, places.sqlite, formhistory.sqlite, Cookies, and Hindsight-extracted reports) where fields like urls.title, moz_places.title, moz_formhistory.value, and other page-derived strings are ingested into CSV/JSONL/XLSX and thus into the agent’s LLM context; these strings originate from third-party websites and user-entered content, not from the operating user.