Re:Insecure by default – hijacking websites that use target=...
by tinus_hn on Wednesday October 05, 2016 @06:07PM
(#12648377)
The problem is that a document in a window opened by a link with target="_blank" unexpectedly has a reference to the document that contains the link, using the window.opener property.
This property has limited functionality but one of the things that are allowed is redirecting the page to something else which is kind of unexpected.
The problem is not websites that use target="_blank", it's browsers that refuse to fix this behavior because of some ill-defined compatibility issue that appears to exist mostly in the heads of developers who don't want to work on a fix.
This property has limited functionality but one of the things that are allowed is redirecting the page to something else which is kind of unexpected.
The problem is not websites that use target="_blank", it's browsers that refuse to fix this behavior because of some ill-defined compatibility issue that appears to exist mostly in the heads of developers who don't want to work on a fix.