It's a setting in chrome. You can't control how the browser interprets the target _blank.

try this

onclick="window.open('http://www.google.com', '_self');

It sounds like there are two concerns here: Is this example vulnerable to XSS? And is it vulnerable in a way that poses a legitimate security concern?

To answer question one, your example is definitely vulnerable to self-XSS. When opening a blank window, the origin is set to that of the window that opened it. So any script run in the window will be able to read cookies and make requests to your site, just the same as if it was running in the same window.

Whether this is a "real" vulnerability depends on the context. Self-XSS is often viewed as a less critical issue than reflected or stored XSS. Some don't consider it a security problem at all. But keep in mind, it's possible that an attacker could try to convince your users to paste malicious code into the preview form, for example, and steal their session token or other sensitive information.

If you want to prevent that, one mitigation I have seen is to open the new window in a different domain. The same-origin policy would then protect resources associated with your main site. See this excellent video by LiveOverflow for more discussion on how sandboxed domains are used to neutralize XSS vulnerabilities.

This should do it:

var myWindow=window.open('');
myWindow.document.write("<div id='hello'>hey<div>");
var range = myWindow.document.createRange();
range.selectNode(myWindow.document.getElementById('hello'));
myWindow.getSelection().addRange(range);
myWindow.select();

While it's no longer possible to do this in Chrome, there are workarounds, such as opening a blank document and writing to it.

var win = window.open();
win.document.write("<img src='"+canvas.toDataURL()+"'/>");

As per Mozilla Developer docs first parameter of open() will be a url. If url is an empty string, then a new blank, empty window (URL about:blank) is created with the default toolbars of the main window. also URLs won't load immediately. When window.open() returns, the window always contains about:blank. The actual fetching of the URL is deferred and starts after the current script block finishes executing. The window creation and the loading of the referenced resource are done asynchronously.

It depends what HTML version you use and if you care about W3C validation. In HTML5 you can use target="_blank" but with previous XHTML versions you couldn't and you had to use JavaScript to achieve the same result and make your site W3C valid. I think that's the only reason why many people used this method.

Of course using Javascript makes that user has to have JavaScript enabled to open this link in new window (and using adblocks/ghostery and similar addons make block some JavaScript) so I think if you only can, you should use target="_blank"