Found during a security audit.
Where: screen.js:3137, popOutPanel — window.open(url.toString(), popupId, 'popup,width=1280,height=420')
Issue: No noopener in the window features, so the popup retains window.opener pointing at the main window, contradicting the plugin's own documented invariant ("No window.opener use").
Impact: Not independently exploitable today — the popup URL is always same-origin and fully constructed from trusted values (window.location.origin), never attacker input — but it widens blast radius if a future XSS ever lands in the popup path.
Suggested fix: Add noopener to the window features string.
Found during a security audit.
Where:
screen.js:3137,popOutPanel—window.open(url.toString(), popupId, 'popup,width=1280,height=420')Issue: No
noopenerin the window features, so the popup retainswindow.openerpointing at the main window, contradicting the plugin's own documented invariant ("Nowindow.openeruse").Impact: Not independently exploitable today — the popup URL is always same-origin and fully constructed from trusted values (
window.location.origin), never attacker input — but it widens blast radius if a future XSS ever lands in the popup path.Suggested fix: Add
noopenerto the window features string.