detect the search queries a user has entered into arbitrary search
engines. All the code needed to steal a user's search queries is
could be embedded into any website either by the website owner or by a
malicious third party through a Cross-site Scripting (XSS) attack.
There it would harvest information about every visitor to that site.
-HMO's website could check if a visitor has been searching other sites about cancer, cancer treatments, or drug rehab centers.
-Advertising networks could gather information about which
topics someone is interested based on their search history and use that
to echance their customer databases.
-Government websites could see if a visitor has been searching for bomb-making instructions.
SPI has published a whitepaper about this technique and has also
release proof of concept code that will steal search engine queries.
Works solid in Firefox, and IE support is a little shaky on multi word