popup / window.open spamEMBEDDED

Open new windows with window.open and inspect popup blocking, allow-popups, opener, and tabnabbing boundaries.

Behavior by sandbox policy

Policy	Expected result
No sandbox	works
`sandbox="allow-scripts"`	blocked
`sandbox="" (strictest)`	blocked

Embed snippet

This snippet uses the dedicated embed page. Paste it into your own service and check rendering or blocking behavior.

The current snippet has no sandbox restrictions. Use it to observe behavior, not as a production default.

<iframe src="https://xss-playground.com/embed/popup-spam?lang=en" title="XSS Playground - popup / window.open spam" width="600" height="420" loading="lazy" referrerpolicy="strict-origin-when-cross-origin"></iframe>

Run

// no logs

Explanation

Browsers block window.open without a user gesture, but right after the user clicks anything in the iframe it typically goes through.
Without allow-popups in sandbox, popups are blocked. If you allow arbitrary-host iframes, drop this keyword.
If the popup is same-origin with its opener, opener-based tabnabbing is possible. Cross-origin parents are largely safe — but opener.location writes are allowed even cross-origin.