3 ms·

What happens if they change `window.opener.location` to a javascript: URI? I'm assuming (well, hoping) it fails to work, but it would be nice to have that confi

• nmjohn 11y ago
  At least in chrome, you get the warning: > Blocked a frame with origin "https://www.google.com" https://www.google.com" from accessing a frame with origin "https://news.ycombinator.com" https://news.ycombinator.com". Protocols, domains, and ports must match. When executing window.opener.location = 'javascript:alert(1);'
• bzbarsky 11y ago
  If you do that cross-origin, the script will not be executed, both per spec and in browsers. That would be a pretty wide-gaping security hole if it worked...