3 ms·

Yes, and if you're running an older browser, then the webserver can provide arbitrary code that just reads the history directly. :)