I have recently been reading about reverse tabnabbing, where a child window can change the url of the parent window if it has access to window.opener (which it has by default unless you explicitly disallow it)

In this case the phishing attack is to change the parent tab url and present a similar UI as some trusted website to get user credentials and assume that user might not be able to notice that the url has changed.

I would like to understand why can't this happen in the child window itself ? Agreed that attention wise there are more chances that user would pay less attention to the parent window after the child window is opened, but after sometime, when the user has not been looking at either of the tabs, wouldn't it be similar to just change the url of the child window instead of the parent window ?

Are there any other security concerns that do not allow this?

  • Tabnabbing involves showing a trusted website in a tab, then later on, a malicious website. Why would the trusted website redirect itself to a malicious one? The malicious website in the child could just be malicious, but that's not tabnabbing, that's just normal phishing. – user253751 Nov 20 '20 at 19:24
  • not going by the technical terms (phishing vs tabnabbing), I just wanted to understand, if the child window, instead of changing the parent url, can change its own url to something else after some time. From the user's perspective both of these would be the same experience after he returns to either of the tabs after a while – gaurav5430 Nov 24 '20 at 6:03
  • Sure it can. But why would it need to? – user253751 Nov 24 '20 at 11:38
  • Because in most of the cases it would not have the parent opener window accessible? Also, it would be easier to just do that? Instead of depending on the parent page – gaurav5430 Nov 24 '20 at 16:06
  • Okay but what's the point of doing the redirect? What's the advantage? Why do a redirect? – user253751 Nov 24 '20 at 16:24

Tabnabbing is when a malicious website that looks like a normal website (say, a blog), after some time, redirects itself to a phishing website that looks like some trusted website. For example, a blog article might redirect itself to a fake Facebook login page. This attack is only likely to be effective when you have lots of tabs open in your browser and you hardly know why, so you can easily be confused.

Reverse tabnabbing is more dangerous, because it can work even if you only have one tab. In reverse tabnabbing, a vulnerable website contains a link to a malicious website. The malicious website will open in a new tab, and then redirect the parent tab (the vulnerable website) to a malicious lookalike. As a result, while you are concentrating on the content of the site in the child tab (for example a blog post), the other tab (the parent) will magically become a phishing site.

So reverse tabnabbing is much more effective because it actually targets a specific website in a specific tab that is likely to be trusted by the victim. In tabnabbing instead, the attacker needs some good luck in general. You asked: why doesn't a child tab just redirect itself instead of redirecting the parent? Because, whenever you can, it's always better to choose reverse tabnabbing over plain tabnabbing.


Your question seems to be: why doesn't a page just redirect itself to a malicious page?

And the answer is: why would it? Instead of redirecting to a page that does malicious stuff, the page could just do the malicious stuff itself.

Sometimes this might be useful to get around a cross-origin policy or similar restrictions. It's not called tabnabbing (or reverse tabnabbing), it's just called a redirect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.