Tabnabbing is a phishing technique that exploits links opened in a new browser tab: the destination page silently replaces the original tab with a fraudulent copy.
The user switches back, recognises the site they left open and enters credentials or personal data into a form controlled by the attacker.
How does a tabnabbing attack work?
The mechanism relies on the ` target="_blank"` attribute.
When a link opens in a new tab, that tab receives a JavaScript reference to the source page—available as ` window.opener`—and can change its address.
Il nome descrive il gesto: sottrarre la scheda mentre l’attenzione è altrove. La variante che agisce dal sito visitato verso quello di provenienza si chiama reverse tabnabbing.
How can you prevent tabnabbing?
The protection is contained in a single line of code. The ` rel="noopener" ` attribute resets that reference; ` rel="noopener noreferrer" ` also hides the referring URL.
Starting in 2021, up-to-date browsers automatically apply the `noopener` attribute to every ` target="_blank"` link; however, the explicit attribute is still recommended for older browsers and to pass security audits.
For website administrators, there’s a basic maintenance rule: every outbound link should have the correct attribute, just as “rel=”sponsored”” is used for commercial content.
It’s the same level of care that goes into fixing broken links, which protects both users’ data and the brand’s reputation.