popstate-hijack-demo

Client-side History API abuse, shown as a safe educational PoC

Made By Aryan Giri

This repository is for authorized security testing, lab work, and education only. The demo is intentionally designed not to trap users, redirect off-site, or persist navigation loops.

What this demonstrates

This project shows how a page can abuse browser session history with:

• history.pushState() to add many fake entries
• popstate handling to intercept back/forward navigation
• UI manipulation that makes a page feel harder to leave
• console logging and counters so defenders can observe the behavior live

This kind of behavior has been used in the wild by deceptive sites that try to keep users on-page, confuse the back button, or make leaving the page feel broken. Modern browser and search-policy guidance explicitly treats back-button hijacking as abusive behavior.

Why this matters

Browsers expose the History API so single-page apps can move between states without full reloads. That same mechanism can be abused if a site:

• spams pushState() to create a large history stack
• reacts to popstate by pushing more states again
• hides important navigation controls
• uses overlays, alerts, or repeated state changes to pressure users into staying

The issue is not a browser “breakout” in the classical sense. It is a UX abuse problem that exploits normal browser behavior.

Demo flow

1. Load the page.
2. Click the button that injects history entries.
3. Use the back button or the simulated back action.
4. Watch the counters, warning box, and console logs.
5. Reset the lab to clear the demo state.

Defense ideas

For product teams

• Avoid using pushState() for every tiny UI change.
• Keep navigation meaningful and reversible.
• Do not re-push history entries inside popstate handlers unless there is a strong reason.
• Make “Back” work predictably on mobile and desktop.
• Test with browser back/forward buttons during QA.

For security teams

• Review client-side routes for excessive history growth.
• Flag pages that call pushState() in tight loops.
• Instrument popstate to detect repeated state churn.
• Check third-party scripts that may alter navigation behavior.
• Build browser-automation tests that verify the back button remains functional.

For defenders building detection

• Monitor unusually high pushState() counts per page view.
• Watch for repeated state changes without visible UI changes.
• Alert on popstate handlers that immediately force another navigation action.
• Treat sudden history-stack growth as a possible anti-user pattern.

Security notes

This repository is intentionally limited to safe demonstration behavior:

• no external redirects
• no forced navigation loops
• no user lockout
• no hidden persistence

The goal is to help teams understand the pattern, reproduce it safely in a lab, and build detection and mitigation.

Related references

Platform documentation

• MDN: History.pushState()

  • https://developer.mozilla.org/en-US/docs/Web/API/History/pushState

• MDN: popstate event

  • https://developer.mozilla.org/en-US/docs/Web/API/Window/popstate_event

• MDN: Working with the History API

  • https://developer.mozilla.org/en-US/docs/Web/API/History_API/Working_with_the_History_API

Policy / guidance

• Google Search Central blog: Back button hijacking spam policy

  • https://developers.google.com/search/blog/2026/04/back-button-hijacking

Research on browser history abuse and privacy leakage

• Browser history re:visited (USENIX WOOT 2018)

  • https://www.usenix.org/conference/woot18/presentation/smith

• PDF version of Browser history re:visited

  • https://cseweb.ucsd.edu/~dstefan/pubs/smith%3A2018%3Abrowser.pdf

• I Still Know What You Visited Last Summer (history sniffing research)

  • https://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.pdf

• Cookies from the Past: Timing Server-side Request Processing Code for History Sniffing (2020)

  • https://s3.eurecom.fr/docs/DTRAP_2020.pdf

• Pixel Thief: Exploiting SVG Filter Leakage in Firefox and Chrome (USENIX Security 2024)

  • https://www.usenix.org/conference/usenixsecurity24/presentation/oconnell