Cross-Site Prompt Injection in Web Agents

Description

The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2607.08147 (opens in a new tab)

Impact

Untrusted web content can cause an agent to click adversarial elements, fill forms, abandon or falsely complete tasks, redirect to malicious sites, or invoke out-of-scope account-management actions. The paper reports average attack success of 85.5% without Prismata across its main adversarial settings; Prismata reduced this to 0.7%.

Affected Systems

• Autonomous browser-based web agents
• BrowserGym
• WebArena
• Playwright-driven Chromium web-agent action interfaces
• Accessibility-tree-based web agents

Mitigation Steps

• Place a deterministic mediation layer between the browser and agent that filters observations and validates every action before execution.
• Derive per-element permissions from the user task and only the element’s DOM root-to-target critical path, excluding unrelated page content from labeling decisions.
• Classify DOM regions by provenance—developer, user, hosted-party, or external—and apply no-read-down/no-write-up traversal so untrusted descendants cannot elevate permissions.
• Prune content origins unnecessary for the task; expose required untrusted content as read-only and disable its interactive identifiers.
• Enforce a minimum capability across scope and provenance labels, rejecting clicks or fills targeting removed or underprivileged elements.
• Re-capture and re-filter page state after every action, using a closed action interface that does not permit arbitrary JavaScript execution.
• Use conservative handling or additional checks when untrusted content lies on an action’s critical path without preceding structural cues; preserve semantic HTML, headings, accessibility labels, and non-state-changing GET behavior.
• Treat the mechanism as defense in depth: the paper notes residual labeling error, captured-versus-live DOM drift, in-scope manipulation, and non-textual attacks remain limitations.

Evidence

• arXiv abstract and §1 (opens in a new tab): The paper describes XSP as indirect prompt injection in user-generated or third-party web content that can hijack a web agent; its motivating scenario has a malicious review steering an agent toward sensitive, out-of-scope actions.
• arXiv §2.1 (opens in a new tab): The threat model permits text injection into posts, comments, reviews, seller listings, advertisements, and embeds on otherwise benign sites, while excluding classical same-origin JavaScript compromise.
• arXiv §4.1 (opens in a new tab): The authors implement three concrete, dynamically injected WebArena templates—Shortcut, Fake Completion, and Ignore Instruction—intended to induce clicks on adversarial pop-up content. Sections 4.1–4.2 provide a safe defensive reproduction reference through the isolated benchmark framework and abstract attack interfaces.
• arXiv §5.1–§5.2 (opens in a new tab): In three-run WebArena experiments, the paper reports average ASR falling from 85.5% without Prismata to 0.7% with it, while task success under attack rises from 4.5% to 23.0%; benign task success changes from 29.9% to 26.6%. These are paper-reported measurements, not independently verified results.
• arXiv §5.2 (opens in a new tab): The reported per-template results reduce Shortcut ASR from 63.9% to 2.1%, and Fake Completion and Ignore Instruction ASR from 92.5% and 100.0% to 0.0%. Adaptive WA20 ASR is reported as 0.0% with Prismata for all three templates.
• arXiv §2.2–§2.4 (opens in a new tab): Prismata’s mitigation combines task-scoped action gating, Biba-inspired provenance parsing, observation redaction/read-only downgrades, and deterministic rejection of overprivileged element-targeting actions.
• arXiv §3 (opens in a new tab): In a corpus of 90,408 untrusted paths, the paper reports 1.2% had actionable descendants; 0.10% lacked preceding structural cues, falling to 0.017% under its web-best-practice assumptions.
• arXiv §5.1 and §5.3 (opens in a new tab): The paper explicitly evaluates GPT-5.4, GPT-5.4-mini, and GPT-5.4-nano as base agents, and evaluates six labelers including GPT-5.4-mini, GPT-5.4-nano, Gemini 3 Flash, GPT-OSS-120B, Qwen3-8B, and MiniMax-M2.5.
• arXiv §6.3 (opens in a new tab): The authors state limitations including model-labeling error, residual no-cue critical paths, captured/live DOM drift, attacks within required privilege scope, and lack of coverage for non-textual multimodal attacks.