Agentic LLM Browsers Expose New Attack Surface for Prompt Injection and Data Theft