mathiasbynens/rel-noopener

Quick demonstration of why `<a rel=noopener>` is needed.

rel=noopener explained

https://mathiasbynens.github.io/rel-noopener/

TL;DR If window.opener is set, a page can trigger a navigation in the opener regardless of security origin. See https://bugs.chromium.org/p/chromium/issues/detail?id=168988 for some background.