// TL;DR
Tabnabbing (tabnapping) is a sneaky phishing technique that takes advantage of browser tabs you’ve left open and stopped paying attention to. Here’s a concrete, everyday scenario — using Facebook — to show exactly how the trick plays out and, more importantly, how to recognise and avoid it. This is a companion to the main tabnabbing writeup; if you want the full mechanism (including the window.opener bug and the rel=”noopener” fix), read that one too.
The technique, briefly
Tabnabbing is a clever phishing and social-engineering method in which an attacker takes advantage of a victim’s unattended, inactive browser tabs. While your attention is on another tab, a background tab can quietly change itself — or get redirected — into a convincing fake login page. When you come back to it, you assume you were logged out and simply log in again, sending your credentials to the attacker.
For the full technical picture of why this is possible — including reverse tabnabbing via window.opener and the one-line rel="noopener" fix — see the main tabnabbing writeup.
A familiar scenario
Here’s how it plays out in practice:
- You’re already logged in to your Facebook account.
- You come across an interesting post with a link and click it. A new tab opens with the content you wanted to read.
- While you’re reading in that new tab, your original Facebook tab — sitting in the background — quietly changes into a fake Facebook login page.
- You switch back to the original tab and see what looks like a logged-out Facebook asking you to sign in again.
- Thinking your session expired, you enter your email and password. Those details go straight to the attacker.
- Often the page then logs you into the real Facebook (you never actually logged out), so nothing seems wrong — and you move on, unaware.
The deception works because the fake page sits where you expect a trusted page to be, and you were never prompted to doubt it.
Why Facebook Is Vulnerable to Tabnabbing?
Facebook links open new tabs without rel="noopener", letting the new page access the original tab via window.opener and redirect it to a fake login page.
Why you fall for it
- You trust your own tabs. You scrutinise links before clicking, but almost never question a tab you opened yourself a few minutes ago.
- “My session expired” is a normal thought. Being asked to log in again is routine, so it doesn’t raise alarm.
- The fake is pixel-perfect. Matching title, favicon, and layout make it indistinguishable at a glance.
- The timing is split. The suspicious moment (clicking a link) and the dangerous moment (re-entering your password) are separated, so your guard is already down by the time it matters.
How to stay safe
- Always check the address bar before logging in. This is the one reliable tell — a fake page can copy everything except the real domain. Make sure you’re on the genuine
facebook.comand that the connection useshttps. - Be suspicious of unexpected re-login prompts. If a tab suddenly asks you to log in again, don’t trust it. Close it and reopen the site fresh from a bookmark or by typing the address.
- Use a password manager. It fills credentials based on the true domain, so on a look-alike page it simply won’t offer to log you in — a quiet but reliable warning.
- Enable two-factor authentication, so a stolen password alone isn’t enough.
- Close tabs you’re done with. Fewer forgotten tabs, fewer chances for one to be turned against you.
Thanks for reading — and keep an eye on your tabs. Happy hacking!
Leave a Reply