Target=”_blank” is an underestimated vulnerability
For anyone that wants to see this in action:<p>- Open a website, let's say google.com<p>- Open a console and type in
   `window.open("<a href="http://xkcd.com")`" rel="nofollow">http://xkcd.com")`</a><p>- Disable your popup blocker and do it again.<p>- Open a console in the new xkcd window and type in
   `window.opener.location = "<a href="https://news.ycombinator.com/user?id=Cpoll"`" rel="nofollow">https://news.ycombinator.com/user?id=Cpoll"`</a><p>Note that Google quietly turned into my profile page. Now, imagine that it instead turned into maliciousgoogle.com, which looks just like Google, and you can see the attack vector.