Window.opener isn’t your problem. Window.opener is sandboxed by CORS. And you need it for things such as oAuth.

Target=“_blank” is your problem. That’s where Window.opener gets exposed. You’re better off finding the “_blank” definition and renaming it so that it’s never triggered, or assigning it to the definition of “self”, etc.