This JavaScript can snoop on other browser tabs to work out what you're visiting
Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work.All the more reason to not have JS on by default, and oppose the growing population of sites which unnecessarily use it. That's been my configuration for many years, and in my experience the vast majority of sites I visit do not require it; in fact, contrary to the frequent "please enable JavaScript for a better experience" banners I see, they're better off without. I'm not against JS in general because there are useful "appsites" that can't serve their purpose without it; just against the practice of allowing your machine to run arbitrary untrusted code by default.