&gt; Note that this also works when index.html and malicious.html are on different origins — window.opener.location is accessible across origins!<p>... Why. Why would anyone (not maliciously) consider this desirable behaviour?