Target=”_blank” is an underestimated vulnerability
For anyone that wants to see this in action:- Open a website, let's say google.com- Open a console and type in
   `window.open("http://xkcd.com")`- Disable your popup blocker and do it again.- Open a console in the new xkcd window and type in
   `window.opener.location = "https://news.ycombinator.com/user?id=Cpoll"`Note that Google quietly turned into my profile page. Now, imagine that it instead turned into maliciousgoogle.com, which looks just like Google, and you can see the attack vector.