Agentic browsers integrate autonomous AI agents into web browsers, enabling users to accomplish web tasks through natural-language instructions. The same-origin policy (SOP) is a fundamental browser security mechanism that prevents unauthorized automated cross-origin data flows induced by scripts. However, whether SOP remains effective in agentic browsers is an open question that has not been systematically studied. In this work, we bridge this gap. We first observe that an agentic browser can itself serve as an automated channel for cross-origin data flows, potentially leading to SOP violations. To investigate this phenomenon, we construct SOPBench, a benchmark for evaluating SOP violations in agentic browsers. Our evaluation shows that existing agentic browsers frequently violate SOP, both in benign settings and under attacks. To address this problem, we propose SOPGuard, an SOP enforcement mechanism tailored to agentic browsers. We implement SOPGuard in BrowserOS, an open-source agentic browser. Extensive evaluations demonstrate that SOPGuard effectively enforces SOP while preserving utility and incurring only a small runtime overhead. Our code and data are available at https://github.com/wxl-lxw/BrowserOS-SOPGuard.

翻译：智能体浏览器将自主AI智能体集成到网络浏览器中，使用户能够通过自然语言指令完成网络任务。同源策略（SOP）是一种基本的浏览器安全机制，可防止脚本引发的未授权自动跨源数据流。然而，SOP在智能体浏览器中是否仍然有效，是一个尚未被系统研究的开放性问题。在本工作中，我们填补了这一空白。我们首先观察到，智能体浏览器本身可以作为跨源数据流的自动化通道，可能导致SOP违规。为了研究这一现象，我们构建了SOPBench，一个用于评估智能体浏览器中SOP违规的基准测试。我们的评估表明，现有的智能体浏览器在良性环境和攻击下均频繁违反SOP。为了解决这一问题，我们提出了SOPGuard，一种专为智能体浏览器定制的SOP执行机制。我们在开源智能体浏览器BrowserOS中实现了SOPGuard。大量评估表明，SOPGuard能有效执行SOP，同时保持实用性且仅带来较小的运行时开销。我们的代码和数据可在 https://github.com/wxl-lxw/BrowserOS-SOPGuard 获取。