It's a setting in chrome. You can't control how the browser interprets the target _blank.

It sounds like there are two concerns here: Is this example vulnerable to XSS? And is it vulnerable in a way that poses a legitimate security concern?

To answer question one, your example is definitely vulnerable to self-XSS. When opening a blank window, the origin is set to that of the window that opened it. So any script run in the window will be able to read cookies and make requests to your site, just the same as if it was running in the same window.

Whether this is a "real" vulnerability depends on the context. Self-XSS is often viewed as a less critical issue than reflected or stored XSS. Some don't consider it a security problem at all. But keep in mind, it's possible that an attacker could try to convince your users to paste malicious code into the preview form, for example, and steal their session token or other sensitive information.

If you want to prevent that, one mitigation I have seen is to open the new window in a different domain. The same-origin policy would then protect resources associated with your main site. See this excellent video by LiveOverflow for more discussion on how sandboxed domains are used to neutralize XSS vulnerabilities.