<story><title>Target=&quot;_blank&quot; – An underestimated vulnerability (2016)</title><url>https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/</url></story><parent_chain></parent_chain><comment><author>Nagyman</author><text>I think&amp;#x2F;hope Chromium&amp;#x27;s recent announcement about &amp;quot;Expanding user protections on the web&amp;quot;, addresses the redirect issue:&lt;p&gt;&amp;gt; When the user interacts with content, things can also go wrong. One example that causes user frustration is when clicking a link opens the desired destination in a new tab, while the main window navigates to a different, unwanted page. Starting in Chrome 65 we&amp;#x27;ll also detect this behavior, trigger an infobar, and prevent the main tab from being redirected. This allows the user to continue directly to their intended destination, while also preserving the context of the page they came from.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.chromium.org&amp;#x2F;2017&amp;#x2F;11&amp;#x2F;expanding-user-protections-on-web.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.chromium.org&amp;#x2F;2017&amp;#x2F;11&amp;#x2F;expanding-user-protections...&lt;/a&gt;</text></comment>
<story><title>Target=&quot;_blank&quot; – An underestimated vulnerability (2016)</title><url>https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/</url></story><parent_chain></parent_chain><comment><author>rdslw</author><text>Google considers (1) it unfixable:&lt;p&gt;&amp;quot;&lt;i&gt;Unfortunately, we believe that this class of attacks is inherent to the current design of web browsers and can&amp;#x27;t be meaningfully mitigated by any single website; in particular, clobbering the window.opener property limits one of the vectors, but still makes it easy to exploit the remaining ones.&lt;/i&gt;&amp;quot;&lt;p&gt;(1) &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;sites.google.com&amp;#x2F;site&amp;#x2F;bughunteruniversity&amp;#x2F;nonvuln&amp;#x2F;phishing-with-window-opener&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;sites.google.com&amp;#x2F;site&amp;#x2F;bughunteruniversity&amp;#x2F;nonvuln&amp;#x2F;ph...&lt;/a&gt;</text></comment>