It's a setting in chrome. You can't control how the browser interprets the target _blank.

It sounds like there are two concerns here: Is this example vulnerable to XSS? And is it vulnerable in a way that poses a legitimate security concern?

To answer question one, your example is definitely vulnerable to self-XSS. When opening a blank window, the origin is set to that of the window that opened it. So any script run in the window will be able to read cookies and make requests to your site, just the same as if it was running in the same window.

Whether this is a "real" vulnerability depends on the context. Self-XSS is often viewed as a less critical issue than reflected or stored XSS. Some don't consider it a security problem at all. But keep in mind, it's possible that an attacker could try to convince your users to paste malicious code into the preview form, for example, and steal their session token or other sensitive information.

If you want to prevent that, one mitigation I have seen is to open the new window in a different domain. The same-origin policy would then protect resources associated with your main site. See this excellent video by LiveOverflow for more discussion on how sandboxed domains are used to neutralize XSS vulnerabilities.

try this

onclick="window.open('http://www.google.com', '_self');

It depends what HTML version you use and if you care about W3C validation. In HTML5 you can use target="_blank" but with previous XHTML versions you couldn't and you had to use JavaScript to achieve the same result and make your site W3C valid. I think that's the only reason why many people used this method.

Of course using Javascript makes that user has to have JavaScript enabled to open this link in new window (and using adblocks/ghostery and similar addons make block some JavaScript) so I think if you only can, you should use target="_blank"

It makes no difference to what happens. The window specification defines the target parameter as being a string with a default value of "_blank":

WindowProxy? open(optional USVString url = "", optional DOMString target = "_blank", optional [LegacyNullToEmptyString] DOMString features = ""); getter object (DOMString name);

(My emphasis.)

So not providing it at all or providing "_blank" does the same thing. It's up to you whether including it is in some way clearer (or alternatively, unnecessary clutter).

In the latest version of browsers this action must be initiated by the user to enhance security and prevent undesired pop-ups (for example, advertisement).

Attach an event listener to the button, which will execute your code. This should ensure the expected functionality.

If you intend to execute the code without direct user interaction, it is a good practice to inform the user and request confirmation by providing an acceptance button.

There is a specific time interval after a user action within which you can execute your code. This interval varies across browsers and cannot be controlled. The general recommendation here is to call window.open() as close to the user action as possible.

This principle applies not only to window.open() but also to other scenarios like a working with a clipboard.

As per Mozilla Developer docs first parameter of open() will be a url. If url is an empty string, then a new blank, empty window (URL about:blank) is created with the default toolbars of the main window. also URLs won't load immediately. When window.open() returns, the window always contains about:blank. The actual fetching of the URL is deferred and starts after the current script block finishes executing. The window creation and the loading of the referenced resource are done asynchronously.