# Reverse Tabnapping

> Detects anchor tags with target="_blank" without rel="noopener noreferrer", allowing opened pages to manipulate the opener.

- Skill: `zakirkun/reverse-tabnapping` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/reverse-tabnapping`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/reverse-tabnapping/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/reverse-tabnapping

---


# Reverse Tabnapping

## Overview
When an `<a>` tag uses `target="_blank"` without `rel="noopener noreferrer"`, the opened page gets a reference to the opener window via `window.opener`. A malicious opened page can redirect the original tab to a phishing page (`window.opener.location = 'https://phishing.com'`).

## Remediation
Always add `rel="noopener noreferrer"` to links with `target="_blank"`:

**Vulnerable:**
```html
<a href="https://external.com" target="_blank">Visit</a>
```

**Safe:**
```html
<a href="https://external.com" target="_blank" rel="noopener noreferrer">Visit</a>
```