The target='_blank' vulnerability

11 February, 2017 · Reading time: ~1 minute(s) (123 words) programming security

For many years, I was a fan of using target="_blank" inside any anchor tags on my website that linked to external sites so it would keep the viewer still on my site in the background so they can easily come back to it later on. However, Ben Halpern describes the problem (with examples) of how it is an issue on this page and how the window/tab containing the origin website (i.e. the one with the target anchor tag) could be manipulated to trick the user into providing details to a fake equivalent site.

(Continue reading)