Security Vulnerabilities Guide

When your site opens a popup or is opened by another site, the two windows can reference each other via window.opener. An attacker can exploit this to navigate your window to a phishing page, access window properties, or perform Spectre-type side-channel attacks to read cross-origin data from memory.

Set Cross-Origin-Opener-Policy to 'same-origin' to fully isolate your window from cross-origin openers. Use 'same-origin-allow-popups' if your site needs to communicate with popups it opens.