target="_blank" Without rel="noopener"

## Why it matters

This flag is worth fixing for hygiene and defence-in-depth, especially for sites supporting older browser versions or embedded webviews that lag behind. However, it's no longer the live exploit it was in the mid-2010s.

Since around 2021, Chrome, Firefox, and Safari all implicitly treat target="_blank" links as if rel="noopener" were set. The browser closes the hole by default. There's also a minor performance angle: without noopener or noreferrer, the new page can share a process with the opener. Isolation prevents that.

## How it works

Without rel="noopener", a newly opened page can access the JavaScript object window.opener, which refers to the page that opened it. A malicious page could redirect the original tab to a phishing site while the user is focused on the new tab.

// On the newly opened malicious page
if (window.opener) {
  window.opener.location = 'https://phishing-site.com';
}
Copy

Adding rel="noopener" (or rel="noreferrer") severs the reference. Modern browsers now apply this by default for target="_blank" links.

## What does not matter

The security risk is no longer material for users on modern browsers. Fixing this flag has shifted from a critical security measure to a hygiene best practice for defence-in-depth and older-browser compatibility. It is not a ranking factor.

## Code example

A link without noopener (historical vulnerability):

<a href="https://example.com" target="_blank">
  Open in new tab
</a>
Copy

The same link with proper security attribute:

<a href="https://example.com" target="_blank" rel="noopener">
  Open in new tab
</a>
Copy

If you also want to strip the referrer header:

<a href="https://example.com" target="_blank" rel="noopener noreferrer">
  Open in new tab
</a>
Copy

## How Scalpel shows it

Scalpel SEO flags links that use target="_blank" without rel="noopener" in the Links panel. It also notes the browser-version context: modern browsers have closed the hole, but the flag remains useful for older-browser support and consistency.

---

## Browser support timeline

• 2020-2021: Chrome, Firefox, Safari, and Edge began implicitly treating target="_blank" as noopener by default.
• Pre-2020: The reverse tabnabbing vulnerability was live and exploitable.
• Modern practice: Explicit rel="noopener" remains a best practice for clarity and legacy-browser support, but the security risk has largely been mitigated at the platform level.