I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent of who or what can access the user's browser history.
By using a script that tests for differences between visited and unvisited links for a given url, an attacker is able to learn which sites have been visited or not.
But who would be the attacker? The web site hosting the web page with the history sniffer script? A third party (i.e., another web site in addition to or instead of the hosting web site?)? Additionally, if a third party has access, does this mean all other subsequent visited sites down the road have this access?