&quot;location&quot; is not blocked cross-origin, because that allows you to navigate windows you opened, or subframes of yourself, even if they happen to not be same-origin with you at the moment.  And it&#x27;s been this way for over 20 years, and sites commonly depend on it.  :(<p>So what you&#x27;re suggesting is either some sort of asymmetric &quot;same-origin&quot; checks or .... something.