Google Chrome will soon be able to block JavaScript redirects when users click on a web page link that opens a URL in either a new window or new tab.
For those unfamiliar, when inserting a link into an HTML page, an author can include the target=“_blank” attribute to tell a web browser to open a link in a new tab. While useful for site owners, this attribute has a known security issue due to the fact that a newly opened page can utilize a JavaScript redirect to open a different URL than the one specified in a site's HTML code.
This means that a threat actor could redirect users to phishing pages or sites hosting malicious files just by adding a JavaScript redirect to links on a webpage.
- We've assembled a list of the best anonymous browsers available
- These are the best web hosting services for your website
- Also check out our roundup of the best VPN services around
Thankfully though, a re:=“noopener” HTML link attribute was created to prevent new tabs from using JavaScript to redirect to another UR.
Preventing JavaScript redirects
Back in 2018 Apple changed the way in which Safari treats all HTML links that use the target=“_blank” attribute to make it so that they automatically imply the noopener attribute. Once enabled, this feature prevents embedded links from redirecting to a different URL.
Microsoft Edge developer Eric Lawrence recently added this exact same feature to Chromium which means that it will soon find its way to Google Chrome, Brave, Vivaldi, Microsoft Edge and all other Chromium-based browsers. Lawrence provided further details on how this feature will work in Chromium in his commit, saying:
“To mitigate "tab-napping" attacks, in which a new tab/window opened by a victim context may navigate that opener context, the HTML standard changed to specify that anchors that target _blank should behave as if |rel="noopener"| is set. A page wishing to opt out of this behavior may set |rel="opener"|.”
Currently this feature is enabled in Chrome Canary but is expected to be included with the release of Chrome 88 in January of next year.
- We've also highlighted the best antivirus software
Via BleepingComputer
