News for hackers. Stuff that matters.

A comment on Target="_blank" – An underestimated vulnerability (2016).

Re:Target="_blank" – An underestimated vulnerability (2016) by carstimon on Monday November 13, 2017 @12:54PM (#15688375)
I'm pretty ignorant of browser stuff, but couldn't the attack be even worse than mentioned in the article?

If the newly opened website has full control over the Facebook tab, can't the attacker directly modify the html in the opener to pop up a form asking for a password? This would be stronger because the address would not change.

Could the attacker reach into the Facebook tab and pull any information from it?

[ Parent | on HN ]
Re:Target="_blank" – An underestimated vulnerability (2016) by paulddraper on Monday November 13, 2017 @01:00PM (#15688424)
No. You do not have access to the contents of the window because facebook.com is on a different origin.

As this article says, you can change the location of the window.

[ Parent | on HN ]