The Opener Backdoor

A link that opened a new tab handed the new page a live handle to the old one, enough to quietly replace it with a fake.

In 2026: Partly. A target=_blank page could read window.opener and set opener.location to a phishing copy of the page behind it, a trick called reverse tabnabbing. Browsers made target=_blank imply noopener from 2019 to 2021 (Safari 12.1, Firefox 79, Chrome 88), so anchors are safe now, but window.open still hands over a live opener. This sandboxed demo cannot navigate its opener, so it just reports what the handle looks like.

Where it came from: The window.opener relationship, Netscape 1996. Reverse tabnabbing named around 2016; implicit noopener shipped in Chrome 88, Firefox 79 and Safari 12.1, 2019 to 2021. MDN ↗

<button onclick="inspect()">Inspect window.opener</button>
<p id="out"></p>

<script language="JavaScript">
function inspect() {
  // The attack was: opener.location = "https://phish.example/login";
  // The opener page would silently become a fake while you read this one.
  var msg = "window.opener is: " + String(window.opener) + ".<br>";
  msg += "Anchors got implicit rel=noopener in 2021, which closed the door "
       + "for target=_blank links. window.open still leaves it ajar.";
  document.getElementById("out").innerHTML = msg;
}
</script>