Agentic browsers integrate autonomous AI agents into web browsers, enabling users to accomplish web tasks through natural-language instructions. The same-origin policy (SOP) is a fundamental browser security mechanism that prevents unauthorized automated cross-origin data flows induced by scripts. However, whether SOP remains effective in agentic browsers is an open question that has not been systematically studied. In this work, we bridge this gap. We first observe that an agentic browser can itself serve as an automated channel for cross-origin data flows, potentially leading to SOP violations. To investigate this phenomenon, we construct SOPBench, a benchmark for evaluating SOP violations in agentic browsers. Our evaluation shows that existing agentic browsers frequently violate SOP, both in benign settings and under attacks. To address this problem, we propose SOPGuard, an SOP enforcement mechanism tailored to agentic browsers. We implement SOPGuard in BrowserOS, an open-source agentic browser. Extensive evaluations demonstrate that SOPGuard effectively enforces SOP while preserving utility and incurring only a small runtime overhead. Our code and data are available at https://github.com/wxl-lxw/BrowserOS-SOPGuard.

翻译：智能代理浏览器将自主人工智能代理集成到网页浏览器中，使用户能够通过自然语言指令完成网页任务。同源策略（SOP）是浏览器的一项基础安全机制，可防止由脚本引发的未授权自动跨源数据传输。然而，同源策略在智能代理浏览器中是否依然有效，是一个尚未经过系统研究的开放性问题。本研究填补了这一空白。我们首先观察到，智能代理浏览器本身可能成为跨源数据流的自动化通道，从而潜在地导致同源策略违规。为探究此现象，我们构建了SOPBench——一个用于评估智能代理浏览器中同源策略违规的基准测试。评估结果表明，现有智能代理浏览器在良性环境及攻击场景下均频繁违反同源策略。为解决此问题，我们提出了SOPGuard——一种专为智能代理浏览器定制的同源策略实施机制。我们在开源智能代理浏览器BrowserOS中实现了SOPGuard。大量实验证明，SOPGuard能在有效执策略的同时保持系统实用性，且仅引入极小的运行时开销。我们的代码与数据已开源在https://github.com/wxl-lxw/BrowserOS-SOPGuard。