Yeah, having never heard of this before, I'm a little shocked. Can you access things like window.opener.document?

Fortunately, tabs created by opening the link using the middle mouse button don't seem to have a useful window.opener. Guess I'll be more deliberate about that habit.

Does it actually work cross domain? That would really surprise me.

Edit: if I understand correctly this only allows the opened page to navigate the opening page; it does not allow it to do anything else to the opener. Is that correct?

I don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files

link.html:

    <a id="link" href="opener.html" target="_blank">Click</a>

opener.html:

    <script>window.opener.document.getElementById("link").href = "https://google.com";</script>

and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?

See this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810

It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.

you cannot access the opener's document as aji's example does cross origin

Sorry, I didn't read the comment carefully enough.

I assumed we were still talking about window.opener.location (which can be modified across domains)