Basically, I am having an <a>
tag with target set to _blank
, where an attacker has control over the href
parameter, thus possible inserting a javascript tag, like the following:
<a target="_blank" href="javascript:alert(document.location)">
However, this XSS executes in a new about:blank
tab because of the target setting.
Is it possible to bypass this, and let the javascript execute on the original page with the control of the href
parameter?