It&#x27;s a bit confusing if you didn&#x27;t pay close attention to the article, because neither link actually show the `rel=noopener` fix.<p>Instead, the two links present two different angles to the same problem. The first link demonstrates the attack using a page within the same domain (reasonable), and the second demonstrates that it will continue to work even when the link points to a page ordinarily restricted by cross-origin policies (potentially surprising).<p>If you manually add `rel=noopener` to either link, the attack won&#x27;t work. Try it with DevTools.