Target="_blank" – An underestimated vulnerability (2016)
Google considers (1) it unfixable:"Unfortunately, we believe that this class of attacks is inherent to the current design of web browsers and can't be meaningfully mitigated by any single website; in particular, clobbering the window.opener property limits one of the vectors, but still makes it easy to exploit the remaining ones."(1) https://sites.google.com/site/bughunteruniversity/nonvuln/ph...