opener property so that the page we open can't call
window.opener and get full control of our Salesforce instance.
The common way to do this (from the article) in code is:
const otherWindow = window.open(); otherWindow.opener = null; otherWindow.location = url;
However, in Salesforce components, the window object appears to be destroyed and not the browser window. So the first call to
window.open() immediately opens a window to a location like:
How do we prevent security flaws with the destroyed Aura component