AIKIDO-2026-11012

TL;DR

The browser allowlist was only enforced on direct navigate() calls, leaving other navigation paths such as link clicks, JavaScript redirects, and history navigation outside the restriction boundary. As a result, a model or attacker controlling browser actions could still reach disallowed domains and interact with unintended external content despite an allowed_domains policy being configured. An attacker might exploit this by placing a cross-domain link on an allowed page, triggering execute_js to set location.href to an attacker-controlled site, or using go_back / go_forward to load previously visited disallowed pages, potentially exposing the model to malicious content, data exfiltration workflows, or policy bypass. The fix adds defense-in-depth by blocking top-level disallowed navigations at the network layer and validating the final page URL after each navigation-capable action.