Google Chrome to block JavaScript redirects on web page URL clicks

Google Chrome
(Image credit: Shutterstpck)
Audio player loading…

Google Chrome (opens in new tab) will soon be able to block JavaScript redirects when users click on a web page link that opens a URL in either a new window or new tab.

For those unfamiliar, when inserting a link into an HTML page, an author can include the target=“_blank” attribute to tell a web browser (opens in new tab) to open a link in a new tab. While useful for site owners, this attribute has a known security issue due to the fact that a newly opened page can utilize a JavaScript redirect to open a different URL than the one specified in a site's HTML code.

This means that a threat actor could redirect users to phishing pages (opens in new tab) or sites hosting malicious files just by adding a JavaScript redirect to links on a webpage.

Thankfully though, a re:=“noopener” HTML link attribute was created to prevent new tabs from using JavaScript to redirect to another UR.

Preventing JavaScript redirects

Back in 2018 Apple changed the way in which Safari treats all HTML links that use the target=“_blank” attribute to make it so that they automatically imply the noopener attribute. Once enabled, this feature prevents embedded links from redirecting to a different URL.

Microsoft Edge (opens in new tab) developer Eric Lawrence recently added this exact same feature to Chromium which means that it will soon find its way to Google Chrome, Brave, Vivaldi, Microsoft Edge and all other Chromium-based browsers. Lawrence provided further details on how this feature will work in Chromium in his commit (opens in new tab), saying:

“To mitigate "tab-napping" attacks, in which a new tab/window opened by a victim context may navigate that opener context, the HTML standard changed to specify that anchors that target _blank should behave as if |rel="noopener"| is set. A page wishing to opt out of this behavior may set |rel="opener"|.”

Currently this feature is enabled in Chrome Canary (opens in new tab) but is expected to be included with the release of Chrome 88 (opens in new tab) in January of next year.

Via BleepingComputer (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.