This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context.

  • What is the about:blank context?

  • How does about:blank, 307 redirect, and CORS relate to this? (or how would I determine this outside of the blog?)

  • Are there additional things that run in the about:blank context besides those listed?

  • Are there other security contexts that run in parallel to about:blank?

  • First of all i don't think its possible to run JS in about:blank (or the local security context) unless you have an 0-day... That being said, about:blank probably isn't useful to anyone.
    – rook
    Commented Mar 29, 2013 at 16:22
  • @rook I'm soon going to experiment with an iFrame with src=about:blank. Test cases and other ideas are welcome Commented Mar 29, 2013 at 16:41
  • Beware when you use about:blank in an https website. The about:blank is in a different zone and some browsers will throw an annoying warning about 'mixed content'
    – Jeff
    Commented Mar 29, 2013 at 16:54
  • In the case of data URI's, IIRC each URI seems isolated from every other. I.e. data:text/html;,foo cannot contact data:text/html;,bar. This may then also apply to about:'s Commented Apr 1, 2013 at 12:08

1 Answer 1


The about:blank is just a blank address-less browser screen, that will inherit the same security parameters of its caller. That said, you cannot exploit about:blank to bridge the JavaScript cross-domain access restrictions if thats what you're asking.

Despite its location is not part of your domain, it belongs to it, and will not run stuff in a different security level.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .