Title
Missing Cross-Origin-Opener-Policy (COOP) Header Allows Cross-Origin Window Attacks and Weakens Browser Isolation
Summary
During the security assessment, it was identified that the Amplenote login page does not return the Cross-Origin-Opener-Policy (COOP) HTTP response header.
Without the COOP header, browser-enforced isolation between the authentication page and cross-origin websites is not established. As a result, malicious websites may retain references to application windows through the window.opener object, increasing the risk of reverse tabnabbing, phishing attacks, cross-window manipulation, XS-Leaks, and weakened browser process isolation.
Since this issue affects the authentication endpoint, it may increase the risk of credential phishing attacks targeting users during the login process. Amplenote's security documentation describes several security headers in use, making COOP a useful additional browser-isolation control if it is indeed absent from the tested endpoint.
Technical Description
The Cross-Origin-Opener-Policy (COOP) response header instructs browsers to isolate top-level documents into their own browsing context group, preventing unsafe interactions through the window.opener object.
During testing of:
https:
the HTTP response did not include:
Cross-Origin-Opener-Policy
A secure configuration should return one of the following:
Cross-Origin-Opener-Policy: same-origin
or
Cross-Origin-Opener-Policy: same-origin-allow-popups
Without this header:
Cross-origin pages may retain access to window.opener.
Reverse tabnabbing attacks become possible.
Browser isolation is weakened.
Protection against XS-Leaks is reduced.
Browser process isolation is less effective.
Client-side vulnerabilities become easier to chain into higher-impact attacks.
Steps to Reproduce
Open:
https:
Intercept the request using Burp Suite or open Developer Tools → Network.
Reload the page.
Select the main HTML document.
Inspect the HTTP response headers.
Observe that the following security header is missing:
Cross-Origin-Opener-Policy
Alternatively verify using:
curl -I https:
Confirm that the response does not include the Cross-Origin-Opener-Policy header.
Working Proof of Concept (PoC)
HTTP Response Verification
curl -I https:
Observed:
HTTP/2 200 OK
Content-Type: text/html
Missing:
Cross-Origin-Opener-Policy
Browser Verification
Open the login page and inspect the Network response headers.
Observed:
Cross-Origin-Opener-Policy:
(Not Present)
Browser Console Verification
Execute:
window.crossOriginIsolated
Output:
false
This indicates that the page is not cross-origin isolated, consistent with the absence of the COOP header.
Demonstration of Exploitation
Scenario 1 – Reverse Tabnabbing
const popup = window.open("https://login.amplenote.com/login");
setTimeout(() => {
if (popup && popup.opener) {
popup.opener.location =
"https://attacker.example/fake-amplenote-login";
}
}, 3000);
If the browser preserves the opener relationship because COOP is not configured, the attacker may redirect the original browser tab to a phishing page impersonating the legitimate login portal.
Scenario 2 – Cross-Window Manipulation
const loginWindow = window.open("https://login.amplenote.com/login");
Without COOP, an attacker-controlled page may retain an opener relationship with the authentication window, enabling unsafe cross-window interactions.
Scenario 3 – Browser Isolation Weakening
Because the page is not cross-origin isolated:
Browser process isolation is weakened.
XS-Leaks become easier to exploit.
Client-side vulnerabilities may have greater impact when chained together.
Attack Scenario
An attacker hosts a malicious website.
A victim visits the attacker's webpage.
The attacker opens the legitimate Amplenote login page.
Due to the missing COOP header, the browser preserves the opener relationship.
The attacker redirects the original browser tab to a fake login page.
The victim enters their credentials believing the page is legitimate.
The attacker captures the credentials and attempts unauthorized access.
User Impact
Successful exploitation may result in:
Credential theft through phishing.
Cross-window manipulation.
Reduced browser security isolation.
Increased exposure to XS-Leaks.
Unauthorized access to user accounts.
Business Impact
The absence of the COOP header may result in:
Increased phishing success rates.
Reduced browser-enforced security boundaries.
Greater likelihood of account compromise.
Loss of customer trust.
Reputational damage.
Increased incident response and remediation costs.
Remediation
Configure the web server to include the following HTTP response header on all HTML pages, especially authentication endpoints:
Cross-Origin-Opener-Policy: same-origin
If trusted popup functionality is required:
Cross-Origin-Opener-Policy: same-origin-allow-popups
Additionally:
Implement Cross-Origin-Embedder-Policy (COEP) where appropriate.
Review usage of window.open() and window.opener.
Apply COOP consistently across authentication and account management pages.
Include COOP in the application's standard HTTP security header baseline.
Validate browser isolation during regular security assessments.