diff --git a/qutebrowser/browser/qutescheme.py b/qutebrowser/browser/qutescheme.py
index 6fc2a8429..7e60b265f 100644
--- a/qutebrowser/browser/qutescheme.py
+++ b/qutebrowser/browser/qutescheme.py
@@ -24,6 +24,7 @@ Module attributes:
_HANDLERS: The handlers registered via decorators.
"""
+import html
import json
import os
import time
@@ -241,8 +242,9 @@ def history_data(start_time, offset=None):
end_time = start_time - 24*60*60
entries = hist.entries_between(end_time, start_time)
- return [{"url": e.url, "title": e.title or e.url, "time": e.atime}
- for e in entries]
+ return [{"url": html.escape(e.url),
+ "title": html.escape(e.title) or html.escape(e.url),
+ "time": e.atime} for e in entries]
@add_handler('history')
diff --git a/tests/end2end/data/issue4011.html b/tests/end2end/data/issue4011.html
new file mode 100644
index 000000000..488193736
--- /dev/null
+++ b/tests/end2end/data/issue4011.html
@@ -0,0 +1,10 @@
+
+
+
+
+ <img src="x" onerror="console.log('XSS')">foo
+
+
+ foo
+
+
diff --git a/tests/end2end/features/history.feature b/tests/end2end/features/history.feature
index 2e2e1712a..13a890c10 100644
--- a/tests/end2end/features/history.feature
+++ b/tests/end2end/features/history.feature
@@ -112,3 +112,8 @@ Feature: Page history
And I wait until qute://history is loaded
Then the page should contain the plaintext "3.txt"
Then the page should contain the plaintext "4.txt"
+
+ Scenario: XSS in :history
+ When I open data/issue4011.html
+ And I open qute://history
+ Then the javascript message "XSS" should not be logged