I've worked out why this is allowed... if you middle click (open in a new tab) a pop up that uses a link (but intercepts the event by default) window.opener wil

I've worked out why this is allowed... if you middle click (open in a new tab) a pop up that uses a link (but intercepts the event by default) window.opener will still work in the new tab. The sibling is right, this should be same domain only.