When a web page opens a link in a new window, the opened page may access the originating page through the window.opener property.

Why is this an issue?

When a page opens a new window or tab using window.open() or <a target="_blank">, the opened page can access the originating page through the window.opener object. If the originating page links to untrusted external content, the opened page can exploit this access to redirect the originating tab to a different URL, a technique known as reverse tabnabbing. This rule raises an issue when a window or tab is opened without disabling opener access using the noopener option or attribute.

What is the potential impact?

Phishing

An attacker can host a malicious page that, when opened from a trusted site, uses window.opener to redirect the originating tab to a fake login page. Users who switch back to the original tab may not notice they have been redirected and may enter their credentials on the phishing site.

How to fix it

Code examples

The following code is vulnerable because the opened page can access the originating window through window.opener.

Noncompliant code example

<a href="https://example.com/" rel="opener" target="_blank"> <!-- Noncompliant -->

Compliant solution

In Chrome 88+, Firefox 79+ or Safari 12.1+ target=_blank on anchors implies rel=noopener which makes the protection enabled by default.

<a href="https://example.com/" target="_blank">

Exceptions

No Issue will be raised when href contains a hardcoded relative url as there it has less chances of being vulnerable. An url is considered hardcoded and relative if it doesn’t start with http:// or https://, and if it does not contain any of the characters {}$()[]

<a href="internal.html" rel="opener" target="_blank">

Resources

Articles & blog posts

Standards