Cybersecurity glossary
What is Reverse Tabnabbing?
Learn what reverse tabnabbing is, how window.opener lets a new page hijack the original tab, why rel noopener matters for target blank links, and how to prevent opener-based phishing.
Definition
Reverse tabnabbing is an attack in which a page opened from a trusted site—typically via target=_blank—retains a reference to the original window through window.opener and navigates that original tab to a phishing page while the user focuses on the new tab.
Why reverse tabnabbing matters
Sites constantly open third-party docs, OAuth pages, and partner links in new tabs. If the opened page can reach window.opener, it may navigate your original tab to a lookalike login while the user is distracted. Reverse tabnabbing turns a convenience feature—target="_blank"—into a phishing pivot against the trusted origin’s tab.
This is especially dangerous on sites that keep long-lived authenticated tabs open.
How reverse tabnabbing works
Trusted page opens a new tab
A link uses target=_blank to an external or attacker-influenced URL.
Opened page keeps window.opener
Without noopener isolation, the new document can reference the opener window.
Opener is redirected
JavaScript sets opener.location to a phishing URL mimicking the original site.
User returns to the old tab
The tab now shows a fake login or support page.
Credentials are captured
Victim submits secrets believing they are back on the real site.
Primary defenses
rel="noopener"
Prevents the opened page from receiving window.opener for that link.
rel="noreferrer"
Hides referrer and historically ensured noopener behavior in more browsers.
COOP headers
Isolates browsing contexts to reduce cross-origin window control.
Avoid untrusted blank targets
Do not open untrusted URLs from authenticated pages without hardening.
Link hygiene comparison
| Pattern | Risk | Recommendation |
|---|---|---|
| target=_blank only | High on older clients; unclear intent | Add explicit noopener |
| target=_blank rel=noopener | Low for opener hijack | Good default |
| target=_blank rel=noopener noreferrer | Low; also reduces referrer leakage | Common hardening choice |
| window.open without noopener features | Similar opener exposure | Use noopener feature flag / null opener |
Implementation checklist
- Add rel="noopener noreferrer" to external target=_blank links by default.
- Audit JavaScript window.open calls for opener isolation.
- Apply COOP on sensitive application origins.
- Treat user-supplied URLs opened in new tabs as high risk.
- Add lint rules or HTML checks for missing noopener on blank targets.
- Educate users to re-check the address bar before re-entering passwords.
- Combine with phishing-resistant MFA so stolen passwords are less useful.
- Retest after introducing new markdown renderers that emit links.
The practical takeaway
Reverse tabnabbing abuses window.opener so a newly opened page can replace the original tab with phishing content. It is a link-handling vulnerability with social-engineering impact.
Always pair target="_blank" with rel="noopener" (and usually noreferrer), isolate windows with COOP where appropriate, and never assume a background authenticated tab stays on your origin.
Related security terms
Tabnabbing
Related phishing pattern that rewrites a background tab without necessarily using opener.
Open Redirect
Often combined with opener attacks to land users on hostile pages.
Cross-Origin Opener Policy (COOP)
Isolation policy that can sever cross-origin window relationships.
Referrer Policy
Related link hygiene; noreferrer also nulls opener in many browsers.
Frequently asked questions
What is reverse tabnabbing?
A newly opened page uses window.opener to change your original tab to a fake site—often a login page—while you are busy in the new tab.
How does target=_blank relate?
Historically, target=_blank gave the opened page an opener reference to the parent. Without noopener, that reference could be abused.
What does rel="noopener" do?
It instructs the browser not to provide window.opener to the opened page, blocking this hijack path for that link.
Is noreferrer needed too?
rel="noopener noreferrer" is a common hardening pair: noreferrer also suppresses referrer leakage and historically implied noopener in some browsers.
Do modern browsers default noopener for target=_blank?
Many modern browsers now treat target=_blank as noopener by default, but explicit rel="noopener" remains best practice for compatibility and clarity.
Can COOP help?
Yes. Cross-Origin-Opener-Policy can isolate browsing contexts and reduce opener-based attacks across origins.
Does reverse tabnabbing steal cookies directly?
It typically phishes credentials by replacing the trusted tab’s UI. Cookie theft is a separate outcome if the victim authenticates to the fake page or if other bugs exist.
References
Explore authoritative guidance and frameworks related to reverse tabnabbing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.