Reverse Tabnapping

Detects anchor tags with target="_blank" without rel="noopener noreferrer", allowing opened pages to manipulate the opener.

zakirkun d558f06 2 files · 2.0 KB Updated

File contents

Reverse Tabnapping

Overview

When an <a> tag uses target="_blank" without rel="noopener noreferrer", the opened page gets a reference to the opener window via window.opener. A malicious opened page can redirect the original tab to a phishing page (window.opener.location = 'https://phishing.com').

Remediation

Always add rel="noopener noreferrer" to links with target="_blank":

Vulnerable:

<a href="https://external.com" target="_blank">Visit</a>

Safe:

<a href="https://external.com" target="_blank" rel="noopener noreferrer">Visit</a>

zakirkun/ice-tea/tree/main/skills/web/tabnapping commit d558f06e48

Frequently asked questions

npx skillmds@latest add zakirkun/reverse-tabnapping