Hacker News Reader

Comment by yeldarb | Hacker News Reader

Does it actually work cross domain? That would really surprise me.

Edit: if I understand correctly this only allows the opened page to navigate the opening page; it does not allow it to do anything else to the opener. Is that correct?

View on HN

I don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files

link.html:

    <a id="link" href="opener.html" target="_blank">Click</a>

opener.html:

    <script>window.opener.document.getElementById("link").href = "https://google.com";</script>

and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?

See this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810

It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.

you cannot access the opener's document as aji's example does cross origin

Sorry, I didn't read the comment carefully enough.

I assumed we were still talking about window.opener.location (which can be modified across domains)

Reply on news.ycombinator.com