Lack of isolation in agentic browsers resurfaces old vulnerabilities
Summary: Trail of Bits researchers exploited inadequate isolation in multiple agentic browsers to carry out attacks functionally similar to cross-site scripting and cross-site request forgery, including planting false information (such as claims that Yuri Gagarin was the first man on the moon) and leaking user data. The firm attributes the flaws to four trust-zone violation classes - injection, context in, reverse context in, and context out - and notes many agentic browsers run on Chromium builds weeks or months behind on security patches.
Bottom line: Because agentic browsers automatically reuse cookies for agent-initiated requests, an injected instruction from an attacker-controlled page or PDF can pull data from any service the user is logged into - bank, healthcare portal, or social account - and exfiltrate it through side channels like DNS queries or Google Search.
Read the original at Trail of Bits Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026