Does this &quot;work&quot; for cross origin requests? If I plant a `target=_blank` in my website, user clicks it, goes to my second website, do I have control over the website the link came from? If not, I don&#x27;t see the security issue. Of course you can XSS yourself, what have you.