That’s already the case! The history API only supports the current origin. From MDN: > The new URL does not need to be absolute; if it's relative, it's resolve

That’s already the case! The history API only supports the current origin. From MDN: > The new URL does not need to be absolute; if it's relative, it's resolved relative to the current URL. The new URL must be of the same origin as the current URL; otherwise, pushState() will throw an exception. This parameter is optional; if it isn't specified, it's set to the document's current URL. https://developer.mozilla.org/en-US/docs/Web/API/History_API#The_pushState%28%29.C2.A0method https://developer.mozilla.org/en-US/docs/Web/API/History_API... The exploit in this article clones the appearance of Google results and competitor websites but leaves the user on the exploiter’s domain, so users who are savvy enough to notice the URL wouldn’t be fooled.