window.opener is leaking to external domains upon redirect on Safari
C
Coinbase
Submitted None
Team Summary
Official summary from Coinbase
Although Coinbase cleared window.opener on external redirects, it was not effective on WebKit-based browsers (Safari) since Safari's cross-origin security prevents the modification of window.opener of a child window if it lies on a different origin, yet still allows the child window to access window.opener.location. The solution, proposed by the reporter, was to add rel="noreferrer noopener" to these external links.
Actions:
Reported by
cablej
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Violation of Secure Design Principles