Hacker News Reader

Comment by aji | Hacker News Reader

I don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files

link.html:

    <a id="link" href="opener.html" target="_blank">Click</a>

opener.html:

    <script>window.opener.document.getElementById("link").href = "https://google.com";</script>

and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?

It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.

you cannot access the opener's document as aji's example does cross origin

Sorry, I didn't read the comment carefully enough.

I assumed we were still talking about window.opener.location (which can be modified across domains)