Ensure that HTML can't be executed when entered on the "Search History" page....

chrome/browser/resources/history.html

Index: chrome/browser/resources/history.html
===================================================================
--- chrome/browser/resources/history.html	(revision 26113)
+++ chrome/browser/resources/history.html	(working copy)
@@ -527,7 +527,7 @@
 HistoryView.prototype.displaySummaryBar_ = function() {
   var searchText = this.model_.getSearchText();
   if (searchText != '') {
-    this.summaryDiv_.innerHTML = localStrings.formatString('searchresultsfor',
+    this.summaryDiv_.textContent = localStrings.formatString('searchresultsfor',
         searchText);
   } else {
     this.summaryDiv_.innerHTML = localStrings.getString('history');