rel=noopener
explained
https://mathiasbynens.github.io/rel-noopener/
TL;DR If window.opener
is set, a page can trigger a navigation in the opener regardless of security origin. See https://bugs.chromium.org/p/chromium/issues/detail?id=168988 for some background.