
The target=“_blank” vulnerability by example - bhalp1
https://dev.to/ben/the-targetblank-vulnerability-by-example
======
vladikoff
Better article on this topic: [https://mathiasbynens.github.io/rel-
noopener/](https://mathiasbynens.github.io/rel-noopener/)

------
andrewclunn
So forgive my ignorance, but this would only be an issue if links can be
placed on your site by others, where they also can embed javascript as part of
the link, yes?

EDIT -

I mean aside from cases where you're intentionally using this on your site for
unscrupulous reasons.

~~~
bhalp1
If you link to my site with target="_blank" and without rel="noopener" or some
other preventative measure, that's all that needs to happen. The JavaScript is
run on the other person's website. So all you have to do is link to their site
and they get access to the location of the tab of the original site. No XSS or
anything needed.

