If you use target=“_blank” you need to also use rel=“noopener noreferrer”
Ben Halpern writes:
If you use the target=“_blank” attribute on a link, and do not accompany it with a rel=“noopener” attribute, you are leaving your users open to a very simple phishing attack.
When a website uses target=“_blank” on their links in order to open a new tab or window, that website gives the new page access to the existing window through the window.opener API, allowing it a few permissions. Some of these permissions are automatically negated by cross-domain restrictions, but window.location is fair game.
In order to restrict the behavior window.opener access, the original page needs to add a rel=“noopener” attribute to any link that has target=“_blank”. However, Firefox does not support that tag, so you should actually use rel=“noopener noreferrer” for full coverage. Some amount of prevention can be acheived through scripting, though, as observed with Twitter, this seems to fail on Safari.
Read more from The Practical Developer