Java scripts on these sites invade the browsers' history cache and finds out what sites the browser has visited. If, for example, the history reveals that the browser routinely visits a particular online banking site, attackers would know what phony banking page to serve up in order to steal login information, according to scientists at the University of California, San Diego.

The latest versions of Firefox, Chrome and Safari block this history sniffing, but earlier versions and all versions of Internet Explorer don't, they say.

History sniffing has been known for years as a possible way to discover what sites a browser has visited, but this is the first time that anyone has shown it actually happening on the open Internet.

The practice isn't widespread, the researchers conclude. They tested the home pages of the top 50,000 global Web sites as ranked by Alexa, a Web statistics company. They found just 46 cases of real history sniffing, one of them being carried out by the site youporn.com, which ranks in the Alexa top 100.