Scope boundary

Owns destination admission, safe fetch, content demotion, browser-runtime admission, and sanitized observation release. It consumes but does not implement browser-context isolation or the outer sandbox network boundary.

AID-I-008.001: AID-H-019 admits destinations, fetched content, browser runtime evidence, and sanitized observations; AID-I-008.001 creates, partitions, and destroys the ephemeral browser context. Safe content admission does not prove browser state isolation.

AID-I-001.004: AID-H-019 applies application-level URL and browser admission policy; AID-I-001.004 enforces the outer sandbox network egress boundary. A URL allow decision must still be constrained by independently enforced network policy.

Sub-techniques

• AID-H-019.001: URL Normalization & Allowlist Filtering
• AID-H-019.002: Secure HTML Rendering & Content Demotion
• AID-H-019.003: Browser Runtime Admission & Sanitized Observation Export Gate

Threat mappings

MITRE ATLAS

• AML.T0011.003 User Execution: Malicious Link
• AML.T0051 LLM Prompt Injection
• AML.T0051.001 LLM Prompt Injection: Indirect
• AML.T0072 Cyber Communication Channel
• AML.T0078 Drive-by Compromise
• AML.T0086 Exfiltration via AI Agent Tool Invocation
• AML.T0100 AI Agent Clickbait
• AML.T0108 AI Agent
• AML.T0113 Steal Web Session Cookie
• AML.T0114 AI Service Web Interface
• AML.T0122 Exploitation of Remote Services

MAESTRO

• Data Exfiltration (L2)
• Compromised RAG Pipelines (L2)
• Input Validation Attacks (L3)
• Agent Tool Misuse (L7)
• Lateral Movement (Cross-Layer)

OWASP LLM Top 10 2026

• LLM01:2026 Prompt Injection
• LLM10:2026 Improper Output Handling

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• ASI01:2026 Agent Goal Hijack
• ASI02:2026 Tool Misuse and Exploitation
• ASI05:2026 Unexpected Code Execution (RCE)
• ASI06:2026 Memory & Context Poisoning

NIST Adversarial Machine Learning 2025

• NISTAML.015 Indirect Prompt Injection
• NISTAML.018 Prompt Injection
• NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

• AITech-1.2 Indirect Prompt Injection
• AITech-4.2 Context Boundary Attacks
• AITech-4.3 Protocol Manipulation
• AITech-9.1 Model or Agentic System Manipulation
• AITech-12.1 Tool Exploitation
• AITech-12.2 Insecure Output Handling
• AITech-14.1 Unauthorized Access
• AISubtech-4.3.3 Server Rebinding Attack
• AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
• AISubtech-12.1.1 Parameter Manipulation
• AISubtech-12.1.3 Unsafe System / Browser / File Execution

Google Secure AI Framework 2.0 - Risks

• IIC: Insecure Integrated Component
• PIJ: Prompt Injection
• SDD: Sensitive Data Disclosure
• RA: Rogue Actions

Databricks AI Security Framework 3.0

• Model Serving - Inference requests 9.1: Prompt inject
• Agents - Core 13.1: Memory Poisoning
• Agents - Core 13.2: Tool Misuse
• Agents - Core 13.11: Unexpected RCE and Code Attacks