> I agree window.opener was a fairly dangerous addition, but it is subject to CORS restrictions. You can't access it from just anywhere. You can't access thing

> I agree window.opener was a fairly dangerous addition, but it is subject to CORS restrictions. You can't access it from just anywhere. You can't access things via opener but you can change the location of opener, that's an easy target for phishing.