If you link to my site with target="_blank" and without rel="noopener" or some other preventative measure, that's all that needs to happen. The JavaScript is run on the other person's website. So all you have to do is link to their site and they get access to the location of the tab of the original site. No XSS or anything needed.