Reverse tabnabbing allowing phishing attacks | AEM
Last updated on May 18, 2021 01:19:08 PM GMT
Reverse tabnabbing allows phishing attacks by using the external links from AEM. For example, the links to the documentation from the "?" symbol.
Is it a serious threat and what to do to avoid that?
Reverse tabnabbing is out of the scope of AEM threat-model as it is a browser issue, which cannot be easily mitigated at the product level.
The following quote from Google security explains this issue:
Unfortunately, we believe that this class of attacks is inherent to the current design of web browsers and can't be meaningfully mitigated by any single website; in particular, clobbering the window. opener property limits one of the vectors but still makes it easy to exploit the remaining ones.