Hate to tell you, some form of this has existed for over 20 years. Once there was .back(), it’s been possible to pollute and corrupt browsing history. Even befo

Hate to tell you, some form of this has existed for over 20 years. Once there was .back(), it’s been possible to pollute and corrupt browsing history. Even before the hashchange event, it was just a matter of polling the current state to detect history changes. The current API was designed to limit obvious abuse, but obvious abuse was already rampant and already too late to deprecate.