Not really an answer but I can tell you what I did.
I first clone the browser repo and try to reproduce how they get the history.
And I started getting:
Permission Denial: reading
com.android.browser.BrowserProvider
So I added:
<uses-permission android:name="com.android.browser.permission.READ_HISTORY_BOOKMARKS" />
But it still is giving me the same error. I google it and I found this Accessing Data With Android Cursors.
Hope it helps.