VULHUB ™

If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage. The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser.

If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage. The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser.