[kaliszad]

Well, the whole API is bad and the name is wrong. It has nothing to do with history, because you can ever only manipulate the top entries. You don't get an array of objects or simply some kind of list of URLs/ strings, you have to know the specific API to do head of stack manipulation basically.

And no, this has nothing to do with security. The browser could easily filter the list for same origin even with the list/ array approach. People just need to invent things that could've been just another data structure perhaps with some kind of Compare And Swap wrapper for concurrency.