{"id":"https://openalex.org/W7160929430","doi":"https://doi.org/10.48550/arxiv.2605.08310","title":"WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation","display_name":"WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation","publication_year":2026,"publication_date":"2026-05-08","ids":{"openalex":"https://openalex.org/W7160929430","doi":"https://doi.org/10.48550/arxiv.2605.08310"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.08310","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.08310","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.08310","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100459796","display_name":"Zhichao Liu","orcid":"https://orcid.org/0000-0001-8102-2399"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Zhichao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076234477","display_name":"Wenbo Pan","orcid":"https://orcid.org/0000-0001-9734-3090"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pan, Wenbo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135973581","display_name":"Haining Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Haining","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042889658","display_name":"Ge Gao","orcid":"https://orcid.org/0000-0001-8670-2385"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gao, Ge","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135986962","display_name":"Tianqing Zhu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhu, Tianqing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135933613","display_name":"Xiaohua Jia","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jia, Xiaohua","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.6819000244140625,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.6819000244140625,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.12389999628067017,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.035999998450279236,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6966999769210815},{"id":"https://openalex.org/keywords/usability","display_name":"Usability","score":0.6564000248908997},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5724999904632568},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5597000122070312},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5472000241279602},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5299000144004822}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8072999715805054},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6966999769210815},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.6564000248908997},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5724999904632568},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5597000122070312},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5472000241279602},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5299000144004822},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4867999851703644},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.41830000281333923},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.35280001163482666},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.29429998993873596},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.29179999232292175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.08310","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.08310","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.08310","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.08310","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Browser":[0],"agents":[1,38],"are":[2],"increasingly":[3],"deployed":[4],"in":[5,57,84,214],"long-horizon":[6,218],"tasks,":[7,156],"which":[8],"require":[9],"executing":[10,122],"extended":[11,159],"action":[12],"chains":[13],"to":[14,28,53,107,115,133,205],"accomplish":[15],"user":[16,78,119],"goals.":[17],"However,":[18],"this":[19],"prolonged":[20],"execution":[21],"process":[22],"provides":[23],"attackers":[24],"with":[25,60,138],"more":[26],"opportunities":[27],"inject":[29],"malicious":[30],"instructions.":[31],"Existing":[32],"prompt":[33],"injection":[34,99],"attacks":[35,47,71],"against":[36,76],"browser":[37,154],"expose":[39],"two":[40,153,193],"key":[41],"gaps:":[42],"(1)":[43],"low":[44],"effectiveness,":[45],"as":[46],"optimized":[48],"for":[49],"toy":[50],"baselines":[51],"fail":[52],"achieve":[54],"end-to-end":[55],"goals":[56,194],"real-world":[58],"scenarios":[59],"complex":[61],"environments":[62],"and":[63,142,161],"longer":[64],"steps;":[65],"(2)":[66],"weak":[67],"stealthiness,":[68],"since":[69],"most":[70],"pit":[72],"the":[73,77,113,117,123,135,139,146,176,179,187,192,203],"attack":[74,124,171],"goal":[75],"goal,":[79],"causing":[80],"a":[81,96,129,169,211],"significant":[82],"drop":[83],"system":[85,143,204],"usability":[86,177],"under":[87],"attack.":[88,100],"To":[89],"address":[90],"these":[91],"gaps,":[92],"we":[93,127],"propose":[94],"WebTrap,":[95],"mid-task":[97],"hijacking":[98,147],"It":[101],"employs":[102],"multi-step":[103],"instruction":[104],"fusion":[105],"steering":[106],"seamlessly":[108],"combine":[109],"both":[110],"goals,":[111],"enabling":[112],"agent":[114,155,215],"resume":[116],"original":[118,180],"task":[120,140],"after":[121],"goal.":[125],"Furthermore,":[126],"design":[128],"context-grounded":[130],"generation":[131],"method":[132,167],"align":[134],"injected":[136],"content":[137],"environment":[141],"instructions,":[144],"maximizing":[145],"success":[148,172],"rate.":[149],"Extensive":[150],"experiments":[151],"on":[152,158],"based":[157],"WASP":[160],"InjecAgent":[162],"environments,":[163],"demonstrate":[164],"that":[165,184,197,220],"our":[166],"achieves":[168],"high":[170],"rate":[173],"while":[174],"preserving":[175],"of":[178],"system.":[181],"We":[182],"find":[183],"WebTrap":[185],"exploits":[186],"agent's":[188],"navigation":[189],"vulnerabilities,":[190],"binding":[191],"so":[195],"tightly":[196],"standard":[198],"defense":[199],"mechanisms":[200],"cannot":[201],"restore":[202],"normal":[206],"operation.":[207],"These":[208],"findings":[209],"reveal":[210],"critical":[212],"vulnerability":[213],"systems":[216],"during":[217],"tasks":[219],"they":[221],"can":[222],"be":[223],"stealthily":[224],"hijacked.":[225]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-13T00:00:00"}