BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views
Yuetian Chen , Kaiyuan Zhang , Yuntao Du , Thomas Li , Mark Tenenholtz , Kyle Polley , Jerry Ma , Denis Yarats , Ninghui Li
- 🏛 Institutions
- Perplexity , Purdue University , Rutgers University
- 📅 Date
- October 12, 2026
- 📑 Publisher
- arXiv
- 💻 Env
- Web
- 🔑 Keywords
TLDR
Introduces BrowseSafe++, an expanded benchmark of 38,675 webpage pairs evaluating prompt injection detection across diverse web contexts, multilingual content, and rendered browser views. Assesses commercial and open detector models, highlighting critical detection gaps when injections exploit visual DOM structures.
Related papers (24)
- SPIDES: Information-Flow Control for Browser AgentsOctober 16, 2026 · arXiv
- WASP: Benchmarking Web Agent Security Against Prompt Injection AttacksApril 22, 2025 · NeurIPS 2025 (Poster)
- MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency InjectionOctober 16, 2026 · arXiv
- MMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationOctober 14, 2026 · arXiv
- SkillLifeBench: Benchmarking Security Across the Lifecycle of Agent SkillsOctober 26, 2026 · arXiv
- What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web SemanticsOctober 15, 2026 · arXiv
- The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never NamedOctober 10, 2026 · arXiv
- AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World ModelOctober 6, 2026 · arXiv
- Securing Computer-Use Agents Against Branch Steering AttacksOctober 2, 2026 · NeurIPS 2026 Workshop on Agents in the Wild
- The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous AgentsSeptember 16, 2026 · arXiv
- Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection GuardrailsSeptember 2, 2026 · arXiv
- WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM AgentsAugust 25, 2026 · arXiv
- WebSP-Eval: Evaluating Web Agents on Website Security and Privacy TasksApril 7, 2026 · arXiv
- Next-Gen CAPTCHAs: Leveraging the Cognitive Gap for Scalable and Diverse GUI-Agent DefenseFebruary 9, 2026 · ICML 2026
- WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web AgentsFebruary 3, 2026 · arXiv
- It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web AgentsDecember 29, 2025 · arXiv
- HackWorld: Evaluating Computer-Use Agents on Exploiting Web Application VulnerabilitiesOctober 14, 2025 · ICLR 2026 (Poster)
- RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS EnvironmentsMay 28, 2025 · ICLR 2026 (Oral)
- WebInject: Prompt Injection Attack to Web AgentsMay 16, 2025 · EMNLP 2025 (Poster)
- MobileJailBench: Red Queen Jailbreak Benchmarking for Mobile AgentsOctober 16, 2026 · arXiv
- MATE: Policy-Aware Security Auditing for Mobile Agents via Synthesis-Driven Trajectory LearningSeptember 19, 2026 · USENIX Security 2026
- AgentHijack: Visual Patch Attacks on Multimodal Computer-Use AgentsSeptember 6, 2026 · arXiv
- SIR: Self-improving Red-teaming for Compute Use AgentsAugust 31, 2026 · arXiv
- Are Android GUI Agents Robust Against Runtime Anomalies? AnTrap: Evaluating Agents in Dynamic Adversarial EnvironmentsAugust 25, 2026 · arXiv