Most organizations don't see this as a valid vulnerability. If you read terms of most bug bounty programs, they almost always specify that window.opener is out

Most organizations don't see this as a valid vulnerability. If you read terms of most bug bounty programs, they almost always specify that window.opener is out of scope.