Couldn't this just follow same domain rules like CORS?
But yeah it could break a lot of things... changing location is bad, but can it really execute JavaScript in the opener context? That would be very serious.
But yeah it could break a lot of things... changing location is bad, but can it really execute JavaScript in the opener context? That would be very serious.
Even then, there is a risk of being surprised. If you open a page on the same site, you may expect that scripts on the opened page can't access the opening page: but because of CORS they can.
Here's a fiddle with a link to another fiddle that copies the contents of a password field from the first fiddle: https://jsfiddle.net/u6rmc49c/3/
The same origin policy for DOM access allows setting the location.href attribute (getting any attribute is still disallowed). Setting location.href also works with frames in both ways, e.g. frame.location.href as well as parent.locaton.href and top.location.href