diff --git a/Tests/LibWeb/Text/expected/navigation/history-pushstate-iframe.txt b/Tests/LibWeb/Text/expected/navigation/history-pushstate-iframe.txt
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/Tests/LibWeb/Text/expected/navigation/history-pushstate.txt b/Tests/LibWeb/Text/expected/navigation/history-pushstate.txt
new file mode 100644
index 0000000000..e60fd8b747
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/navigation/history-pushstate.txt
@@ -0,0 +1 @@
+  history object length has changed by 1
\ No newline at end of file
diff --git a/Tests/LibWeb/Text/input/navigation/history-pushstate-iframe.html b/Tests/LibWeb/Text/input/navigation/history-pushstate-iframe.html
new file mode 100644
index 0000000000..ae62b21d47
--- /dev/null
+++ b/Tests/LibWeb/Text/input/navigation/history-pushstate-iframe.html
@@ -0,0 +1,20 @@
+<script src="../include.js"></script>
+<script>
+    try {
+        const initialHistoryLength = window.history.length;
+
+        history.pushState({}, "hello", "history-pushstate-iframe.html#hello");
+
+        if (window.self !== window.top) {
+            parent.postMessage(
+                "history object length has changed by " +
+                    (window.history.length - initialHistoryLength),
+                "*"
+            );
+        } else {
+            test(() => {});
+        }
+    } catch (e) {
+        if (window.self !== window.top) parent.postMessage("ERROR:" + e, "*");
+    }
+</script>
diff --git a/Tests/LibWeb/Text/input/navigation/history-pushstate.html b/Tests/LibWeb/Text/input/navigation/history-pushstate.html
new file mode 100644
index 0000000000..60a12d1654
--- /dev/null
+++ b/Tests/LibWeb/Text/input/navigation/history-pushstate.html
@@ -0,0 +1,23 @@
+<script src="../include.js"></script>
+<iframe id="testIframe" src="about:blank"></iframe>
+<script>
+    asyncTest(async done => {
+        const iframe = document.getElementById("testIframe");
+
+        function navigateIframe(src) {
+            return new Promise(resolve => {
+                iframe.addEventListener("load", () => {
+                    resolve();
+                });
+                iframe.src = src;
+            });
+        }
+
+        window.addEventListener("message", event => {
+            println(event.data);
+            done();
+        });
+
+        await navigateIframe("./history-pushstate-iframe.html");
+    }); 
+</script>
diff --git a/Userland/Libraries/LibWeb/HTML/History.cpp b/Userland/Libraries/LibWeb/HTML/History.cpp
index b221b746fa..ed38535464 100644
--- a/Userland/Libraries/LibWeb/HTML/History.cpp
+++ b/Userland/Libraries/LibWeb/HTML/History.cpp
@@ -38,17 +38,17 @@ void History::visit_edges(Cell::Visitor& visitor)
 }
 
 // https://html.spec.whatwg.org/multipage/history.html#dom-history-pushstate
+// The pushState(data, unused, url) method steps are to run the shared history push/replace state steps given this, data, url, and "push".
 WebIDL::ExceptionOr<void> History::push_state(JS::Value data, String const&, Optional<String> const& url)
 {
-    // NOTE: The second parameter of this function is intentionally unused.
-    return shared_history_push_replace_state(data, url, IsPush::Yes);
+    return shared_history_push_replace_state(data, url, HistoryHandlingBehavior::Push);
 }
 
 // https://html.spec.whatwg.org/multipage/history.html#dom-history-replacestate
+// The replaceState(data, unused, url) method steps are to run the shared history push/replace state steps given this, data, url, and "replace".
 WebIDL::ExceptionOr<void> History::replace_state(JS::Value data, String const&, Optional<String> const& url)
 {
-    // NOTE: The second parameter of this function is intentionally unused.
-    return shared_history_push_replace_state(data, url, IsPush::No);
+    return shared_history_push_replace_state(data, url, HistoryHandlingBehavior::Replace);
 }
 
 // https://html.spec.whatwg.org/multipage/history.html#dom-history-length
@@ -145,7 +145,7 @@ bool can_have_its_url_rewritten(DOM::Document const& document, AK::URL const& ta
 }
 
 // https://html.spec.whatwg.org/multipage/history.html#shared-history-push/replace-state-steps
-WebIDL::ExceptionOr<void> History::shared_history_push_replace_state(JS::Value value, Optional<String> const& url, IsPush)
+WebIDL::ExceptionOr<void> History::shared_history_push_replace_state(JS::Value value, Optional<String> const& url, HistoryHandlingBehavior history_handling)
 {
     // 1. Let document be history's associated Document.
     auto& document = m_associated_document;
@@ -188,10 +188,11 @@ WebIDL::ExceptionOr<void> History::shared_history_push_replace_state(JS::Value v
     ///          with navigationType set to historyHandling, isSameDocument set to true, destinationURL set to newURL,
     //           and classicHistoryAPIState set to serializedData.
     // FIXME: 9. If continue is false, then return.
-    // FIXME: 10. Run the URL and history update steps given document and newURL, with serializedData set to
-    //            serializedData and historyHandling set to historyHandling.
 
-    dbgln("FIXME: Implement shared_history_push_replace_state.");
+    // 10. Run the URL and history update steps given document and newURL, with serializedData set to
+    //     serializedData and historyHandling set to historyHandling.
+    perform_url_and_history_update_steps(document, new_url, history_handling);
+
     return {};
 }
 
diff --git a/Userland/Libraries/LibWeb/HTML/History.h b/Userland/Libraries/LibWeb/HTML/History.h
index 481ac94f30..699f64e4ec 100644
--- a/Userland/Libraries/LibWeb/HTML/History.h
+++ b/Userland/Libraries/LibWeb/HTML/History.h
@@ -8,6 +8,7 @@
 #pragma once
 
 #include <LibWeb/Bindings/PlatformObject.h>
+#include <LibWeb/HTML/HistoryHandlingBehavior.h>
 #include <LibWeb/WebIDL/ExceptionOr.h>
 
 namespace Web::HTML {
@@ -36,11 +37,7 @@ private:
     virtual void initialize(JS::Realm&) override;
     virtual void visit_edges(Cell::Visitor&) override;
 
-    enum class IsPush {
-        No,
-        Yes,
-    };
-    WebIDL::ExceptionOr<void> shared_history_push_replace_state(JS::Value data, Optional<String> const& url, IsPush is_push);
+    WebIDL::ExceptionOr<void> shared_history_push_replace_state(JS::Value data, Optional<String> const& url, HistoryHandlingBehavior);
 
     JS::NonnullGCPtr<DOM::Document> m_associated_document;
 };