I think this is an old issue, but I only just learned about it via a lint error react/jsx-no-target-blank I got in a react project.
Apparently a new window opened by a link, has access to the originating window object.
When this new window is another (malicious) site, it has access to the dom of the site that linked it.
Adding rel=”noopener noreferrer” to your anchor tag mitigates this risk.
Check this much better quick decent explanation:
https://mathiasbynens.github.io/rel-noopener/
Spare Time Code 