From ac1f68a7b9777f4aa0b8c41565d3696366151196 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 22 Aug 2026 00:47:25 +0000
Subject: [PATCH] Fix reverse tabnabbing vulnerability in extension sidepanel

Adds the missing `rel="noopener noreferrer"` attribute to the external link
with `target="_blank"` on the AI Studio API key field in `extension/sidepanel/index.html`.
This mitigates a potential reverse tabnabbing attack where the newly opened window
could gain access to the originating window's context.

Co-authored-by: savvides <1580637+savvides@users.noreply.github.com>
---
 extension/sidepanel/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extension/sidepanel/index.html b/extension/sidepanel/index.html
index 989d843..44b94c6 100644
--- a/extension/sidepanel/index.html
+++ b/extension/sidepanel/index.html
@@ -97,7 +97,7 @@ <h3>Settings & Privacy</h3>
         <div class="form-group">
           <label for="api-key-input">Google AI Studio API Key (Optional BYOK)</label>
           <input type="password" id="api-key-input" placeholder="AIzaSy..." />
-          <a id="get-api-key-link" href="https://aistudio.google.com/app/apikey" target="_blank" class="help-link">Get your free Google AI Studio key &rarr;</a>
+          <a id="get-api-key-link" href="https://aistudio.google.com/app/apikey" target="_blank" rel="noopener noreferrer" class="help-link">Get your free Google AI Studio key &rarr;</a>
           <p class="help-text">Leave blank to use the built-in free demo tier.</p>
         </div>
         <button id="save-settings-btn" class="secondary-btn">Save Settings</button>