Accessibility-tree injection safety

What it checks

The extension reads the aria-label, alt, title and placeholder attributes on the rendered page and looks for text shaped like an instruction to an AI model. It matches phrases such as:

• “ignore previous instructions” (or “prior”, “above”, “all previous”)
• “disregard the above” or “disregard previous”
• “system prompt”
• “you are now …”
• “new instructions:”

This check deliberately includes elements a person cannot see, such as zero-opacity or zero-size text, because that is how an instruction is hidden from people while staying readable to an agent. It only skips elements removed from the accessibility tree altogether (hidden, inert, aria-hidden="true", display: none or visibility: hidden), since an agent never sees those either.

Results

Status	When
Pass	No instruction-shaped text was found
Fail	One or more attributes contain instruction-shaped text
Unmeasured	The extension could not read the page (open it in the active tab)

The result quotes each matching attribute.

How to fix

Remove command-style text aimed at a reader from aria-label, alt, title and placeholder. These attributes should describe the element, not address whoever is reading the page.

If you did not put the text there, treat it as a security problem: look for injected content from user submissions, third-party widgets or a compromised plugin. Agents and the tools that protect them may flag the page as a prompt injection attempt.

Support by agent and browser

Announced means the vendor’s own docs or announcement say so. Published is the date on the vendor’s own page, where it has one. Checked is the last time our weekly research found that page still saying so.

Agent	Status	Source
AI assistants
Claude Anthropic	Supported (announced)	Claude blog: Piloting Claude in Chrome Published 25 Aug 2025 · Checked 9 Oct 2026Claude in Chrome reads DOM content invisible to humans: 'hidden malicious form fields in a webpage's Document Object Model (DOM) invisible to humans ... URL text and tab title that only an agent might see.' Post updated through 2025-12-18. See also Use Claude in Chrome safely (support.claude.com/en/articles/12902428) and the browser use tool's injection classifiers.
AI browsers
Comet Perplexity	Partial support	partial BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents (Perplexity / Purdue, arXiv 2511.20597) Published 25 Nov 2025 · Checked 9 Oct 2026Perplexity co-authored paper; benchmark built from Comet agent tool outputs. Hidden-injection strategies include 'HTML comment, data attribute, CSS-hidden text, form hidden fields, and semantic attribute abuse'. Not an explicit statement that aria-label/alt are passed to Comet.
Gemini in Chrome Google	Supported (announced)	Google blog: Architecting security for agentic capabilities in Chrome Published 8 Dec 2025 · Checked 9 Oct 2026Indirect prompt injection 'can appear in malicious sites, third-party content in iframes, or from user-generated content'; Gemini plans from 'page content shared in Chrome'. Defences: User Alignment Critic, origin gating, confirmations. Does not say which attributes are included.

No evidence yet24

• ChatGPT
• Gemini
• Perplexity
• Copilot
• Meta AI
• ChatGPT Atlas
• Dia
• Edge Copilot Mode
• Claude Code
• Cursor
• Codex
• GitHub Copilot
• Windsurf
• CCBot
• Applebot
• Amazonbot
• Bytespider
• Cohere
• Mistral
• DuckAssist
• Chrome
• Edge
• Firefox
• Safari

Names and marks belong to their owners and are used only to identify products. None of these vendors is affiliated with Sitebulb. Spotted something out of date? Send a correction.

Adoption on the top 100 sites

100%

100 of 100 measured sites implement it

Scanned 23 Oct 2026 with the Sitebulb Labs extension, against the Tranco list (tranco-56Z8N).

Sites implementing it100

1. #1 google.com
2. #2 cloudflare.com
3. #3 aws.amazon.com (via amazonaws.com)
4. #4 facebook.com
5. #5 gstatic.com
6. #8 googleapis.com
7. #9 microsoft.com
8. #11 youtube.com
9. #12 apple.com
10. #13 instagram.com
11. #15 mail.ru
12. #16 x.com (via twitter.com)
13. #18 linkedin.com
14. #20 dzen.ru
15. #23 googletagmanager.com
16. #24 azure.microsoft.com (via azure.com)
17. #26 m365.cloud.microsoft (via office.com)
18. #27 outlook.live.com (via live.com)
19. #29 amazon.com
20. #32 github.com
21. #33 wikipedia.org
22. #37 fastly.com (via fastly.net)
23. #39 whatsapp.com (via whatsapp.net)
24. #42 bing.com
25. #43 netflix.com
26. #44 triplinkintl.com
27. #45 googleusercontent.com
28. #48 gandi.net
29. #50 marketingplatform.google.com (via doubleclick.net)
30. #52 uk.pinterest.com (via pinterest.com)
31. #53 icloud.com
32. #55 wordpress.org
33. #56 teams.live.com (via skype.com)
34. #57 cloudflare.net
35. #59 goo.gl
36. #60 digicert.com
37. #61 adobe.com
38. #63 tiktok.com
39. #67 domains.google (via googledomains.com)
40. #68 zoom.com (via zoom.us)
41. #69 uk.yahoo.com (via yahoo.com)
42. #70 sso.myfritz.net (via myfritz.net)
43. #71 endpoints.news
44. #72 api.whatsapp.com (via wa.me)
45. #75 roblox.com
46. #76 opera.com
47. #77 open.spotify.com (via spotify.com)
48. #80 baidu.com
49. #81 tiktokv.com
50. #83 ya.ru (via yandex.net)
51. #84 nginx.org
52. #85 ntp.org
53. #86 msn.com
54. #87 qq.com
55. #90 vimeo.com
56. #91 primevideo.com (via amazonvideo.com)
57. #93 bunny.net (via b-cdn.net)
58. #94 blogger.com (via blogspot.com)
59. #95 mozilla.org
60. #96 f5.com
61. #98 telegram.org (via t.me)
62. #99 store.epicgames.com (via epicgames.com)
63. #101 wordpress.com
64. #103 reddit.com
65. #106 sentry.io
66. #107 letsencrypt.org (via lencr.org)
67. #109 ui.com
68. #110 european-union.europa.eu (via europa.eu)
69. #112 chatgpt.com
70. #114 st.okcdn.ru (via okcdn.ru)
71. #116 bitly.com (via bit.ly)
72. #117 ipify.org
73. #119 nic.ru
74. #120 samsung.com
75. #121 office365.com
76. #122 intuit.com
77. #123 aliyuncs.com
78. #127 openai.com
79. #128 one.one.one.one (via cloudflare-dns.com)
80. #130 registrar-servers.com
81. #131 pages.github.com (via github.io)
82. #132 dropbox.com
83. #133 skybridge.click
84. #135 discord.com (via discord.gg)
85. #136 developer.adobe.com (via adobe.io)
86. #139 apache.org
87. #140 android.com
88. #141 nih.gov
89. #144 vk.ru
90. #147 reg.ru
91. #150 t-online.de
92. #151 archive.org
93. #152 forms.gle
94. #153 webex.com
95. #154 snapchat.com
96. #156 godaddy.com
97. #158 kaspersky.co.uk (via kaspersky.com)
98. #159 firebase.google.com (via crashlytics.com)
99. #160 tumblr.com
100. #161 nytimes.com

Overview

5/9

Gaining traction

Real support exists and adoption is growing.

How this rating is worked out5 of 9 points

Factor	Points	Why
Vendor support	2 / 3	2 vendors supporting, 1 partly or planned
Top-100 adoption	3 / 3	100% of measured sites
Spec maturity	0 / 3	Community proposal

8 or more points is Established, 5 to 7 is Gaining traction, 2 to 4 is Speculative and under 2 is Stalled. A feature is also Stalled when more vendors have said no than yes. Read the spec.

Community insights

No community insights for this feature yet.

Quotes are from public posts, checked against the original before they appear here. Suggest an insight, or ask for yours to be removed.