COOP Tabnabbing PoC
Demonstrates a missing Cross-Origin-Opener-Policy: a window opened from this page keeps an opener reference, so this page can silently navigate it somewhere else.
How it works
The target is opened in a named window. Five seconds later this page uses the handle it kept to point that window at a harmless landing page. A target that sends Cross-Origin-Opener-Policy: same-origin severs the handle and is unaffected.
Use it only against sites you are authorised to test.
Can also be passed as ?target= in the URL, which launches on load.