It's a setting in chrome. You can't control how the browser interprets the target _blank.

It sounds like there are two concerns here: Is this example vulnerable to XSS? And is it vulnerable in a way that poses a legitimate security concern?

To answer question one, your example is definitely vulnerable to self-XSS. When opening a blank window, the origin is set to that of the window that opened it. So any script run in the window will be able to read cookies and make requests to your site, just the same as if it was running in the same window.

Whether this is a "real" vulnerability depends on the context. Self-XSS is often viewed as a less critical issue than reflected or stored XSS. Some don't consider it a security problem at all. But keep in mind, it's possible that an attacker could try to convince your users to paste malicious code into the preview form, for example, and steal their session token or other sensitive information.

If you want to prevent that, one mitigation I have seen is to open the new window in a different domain. The same-origin policy would then protect resources associated with your main site. See this excellent video by LiveOverflow for more discussion on how sandboxed domains are used to neutralize XSS vulnerabilities.

try this

onclick="window.open('http://www.google.com', '_self');

This is a trick,

function openInNewTab(url) {
  window.open(url, '_blank').focus();
}

// Or just
window.open(url, '_blank').focus();

In most cases, this should happen directly in the onclick handler for the link to prevent pop-up blockers, and the default "new window" behavior. You could do it this way, or by adding an event listener to your DOM object.

<div onclick="openInNewTab('www.test.com');">Something To Click On</div>

Reference: Open a URL in a new tab using JavaScript

As per Mozilla Developer docs first parameter of open() will be a url. If url is an empty string, then a new blank, empty window (URL about:blank) is created with the default toolbars of the main window. also URLs won't load immediately. When window.open() returns, the window always contains about:blank. The actual fetching of the URL is deferred and starts after the current script block finishes executing. The window creation and the loading of the referenced resource are done asynchronously.

This should do it:

var myWindow=window.open('');
myWindow.document.write("<div id='hello'>hey<div>");
var range = myWindow.document.createRange();
range.selectNode(myWindow.document.getElementById('hello'));
myWindow.getSelection().addRange(range);
myWindow.select();