Target="_blank" – An underestimated vulnerability (2016)
Google considers (1) it unfixable:<p>"<i>Unfortunately, we believe that this class of attacks is inherent to the current design of web browsers and can't be meaningfully mitigated by any single website; in particular, clobbering the window.opener property limits one of the vectors, but still makes it easy to exploit the remaining ones.</i>"<p>(1) <a href="https://sites.google.com/site/bughunteruniversity/nonvuln/phishing-with-window-opener" rel="nofollow">https://sites.google.com/site/bughunteruniversity/nonvuln/ph...</a>