6 ms·
It could be some kind of 'target blank' attack, if you have Gmail open in one tab then open a link from a linkedin email onto their site, they have access to yo
by Cozumel 10y ago
It could be some kind of 'target blank' attack, if you have Gmail open in one tab then open a link from a linkedin email onto their site, they have access to your gmail window and can probably get your contacts.
Couple of examples explaining it better than I can:
https://dev.to/ben/the-targetblank-vulnerability-by-example https://dev.to/ben/the-targetblank-vulnerability-by-example
https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/ https://www.jitbit.com/alexblog/256-targetblank---the-most-u...
- mediumdeviation 10y agoCross-origin window.opener objects are not full window objects. You can test this out on any browser - the most they can do is what the articles you linked to says - redirect the parent window, which can be used for phishing, but is otherwise relatively harmless.