GitHub - mikewest/coop-by-default: Wouldn't it be nice if `Cross-Origin-Opener-Policy` was applied by default?When a web application opens another origin in a window, it obtains a JavaScript reference to that context that it can reach through to poke at various things. The opened context likewise receives a reference to its opener which provides similar access. This communication channel between the two windows enables attacks both at the web API level (postMessage vulnerabilities, navigation trickery, an
