Cybersecurity glossary
What is Tabnabbing?
Learn what tabnabbing is, how attackers replace background tabs with phishing pages, why users fall for reused login UI, and how to reduce tabnabbing risk for web apps.
Definition
Tabnabbing is a phishing technique in which an attacker-controlled page silently changes a background browser tab to resemble a legitimate login screen—often after the user leaves the tab idle—so the victim returns and submits credentials to the fake page.
Why tabnabbing matters
Users juggle many tabs. Attention returns in fragments. Tabnabbing exploits that habit: a page the user already “accepted” morphs into a convincing login form while sitting in the background. The victim’s mental model—“I already opened my bank”—overrides careful URL checking.
It is phishing with a timing twist rather than a classic email link alone.
How tabnabbing works
Victim opens attacker page
Often via email, chat, search ads, or compromised content.
Page waits for blur / inactivity
Script detects the tab is no longer focused.
UI is rewritten
Document title, favicon, and DOM change to mimic a trusted login.
Victim returns to the tab
Multitasking makes the change feel like a session timeout prompt.
Credentials are harvested
Submitted secrets go to the attacker instead of the real site.
Why the trick succeeds
Favicon trust
Users glance at icons more than full hostnames under time pressure.
Session timeout narratives
Fake ‘please sign in again’ messages feel normal.
Tab continuity
People assume an already-open tab remains the same site.
HTTPS lock icon
TLS on an attacker domain still shows a lock, which is not brand proof.
Mitigations for product teams
| Control | Benefit |
|---|---|
| Phishing-resistant MFA (passkeys/WebAuthn) | Stolen passwords alone fail |
| Clear security UI copy | Teach users to verify origin on re-auth prompts |
| Avoid surprising re-auth loops | Fewer opportunities for fake timeout narratives |
| Brand monitoring / Safe Browsing reports | Faster takedown of lookalike hosts |
| User education in-product | Address-bar verification habits |
User and org checklist
- Re-read the full domain before typing passwords into any tab.
- Prefer passkeys or hardware MFA for high-value accounts.
- Be suspicious of sudden login forms in old background tabs.
- Use bookmark-driven navigation to real sites for sensitive accounts.
- For enterprises: filter known phishing hosts and limit risky extensions.
- Report lookalike domains impersonating your brand quickly.
- Do not rely on favicon or padlock as proof of legitimacy.
- Train staff on tabnabbing as a distinct phishing variant.
The practical takeaway
Tabnabbing phishes users by rewriting a background tab into a fake login experience they later trust. It weaponizes multitasking more than a single malicious click.
Passkeys and careful origin checking beat password-only defenses—and product teams should avoid training users to treat unexpected re-auth screens as routine.
Related security terms
Reverse Tabnabbing
Related attack where a opened page hijacks the original tab via window.opener.
Open Redirect
Redirect flaws often used in phishing chains alongside tabnabbing.
Cross-Site Scripting (XSS)
Injection that can help an attacker control a tab’s content for phishing.
Browser Fingerprinting
Another client-side tracking/abuse technique, distinct from credential phishing.
Frequently asked questions
What is tabnabbing in simple terms?
A phishing page waits until you switch away, then quietly turns into a fake login screen for a site you trust. When you come back, you may type your password into the fake tab.
How is tabnabbing different from reverse tabnabbing?
Tabnabbing changes the attacker’s own tab while it is in the background. Reverse tabnabbing uses window.opener to change the original site’s tab after opening a new page.
Why do people fall for it?
Users trust tabs they already opened and often check favicons more than full URLs after multitasking.
Can websites fully prevent tabnabbing?
Not completely—it is primarily a user phishing technique. Sites can still help with phishing-resistant MFA, clear URL education, and avoiding designs that train users to ignore the address bar.
Does HTTPS stop tabnabbing?
No. The phishing page can also be served over HTTPS on an attacker domain.
What should users look for?
Re-check the full origin in the address bar before entering credentials, especially after returning to an old tab.
Is tabnabbing still used?
Yes as a social-engineering pattern. Browser UI has improved, but multitasking users remain vulnerable.
References
Explore authoritative guidance and frameworks related to tabnabbing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.