From d8792780be52edca77a80f3f7a91a4a9868ea77b Mon Sep 17 00:00:00 2001 From: iyoriovo Date: Fri, 16 Oct 2026 10:51:37 +0700 Subject: [PATCH 1/2] fix(web-components): pass noopener to window.open in anchor-button navigation Modified activations (Ctrl/Cmd+Click, Ctrl/Cmd+Enter) opened links via window.open without noopener, bypassing rel="noopener noreferrer". Fixes #36901 Signed-off-by: iyoriovo --- packages/web-components/src/anchor-button/anchor-button.base.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/web-components/src/anchor-button/anchor-button.base.ts b/packages/web-components/src/anchor-button/anchor-button.base.ts index 9681f2a382299..315ef92cbb1f9 100644 --- a/packages/web-components/src/anchor-button/anchor-button.base.ts +++ b/packages/web-components/src/anchor-button/anchor-button.base.ts @@ -208,7 +208,7 @@ export class BaseAnchor extends FASTElement { * @internal */ private handleNavigation(newTab: boolean): void { - newTab ? window.open(this.href, '_blank') : this.internalProxyAnchor.click(); + newTab ? window.open(this.href, '_blank', 'noopener,noreferrer') : this.internalProxyAnchor.click(); } /** From 6cee564ea8c6424a6f7a074eeb365b9aaa5f3040 Mon Sep 17 00:00:00 2001 From: iyoriovo Date: Fri, 16 Oct 2026 10:53:48 +0700 Subject: [PATCH 2/2] chore: add change file for anchor-button noopener fix Signed-off-by: iyoriovo --- change/@fluentui-web-components-iyoriovo-noopener-1.json | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 change/@fluentui-web-components-iyoriovo-noopener-1.json diff --git a/change/@fluentui-web-components-iyoriovo-noopener-1.json b/change/@fluentui-web-components-iyoriovo-noopener-1.json new file mode 100644 index 0000000000000..faf0df8bb6222 --- /dev/null +++ b/change/@fluentui-web-components-iyoriovo-noopener-1.json @@ -0,0 +1,7 @@ +{ + "type": "patch", + "comment": "anchor-button: pass noopener,noreferrer to window.open for modified-click navigation", + "packageName": "@fluentui/web-components", + "email": "iyorixy1@gmail.com", + "dependentChangeType": "patch" +}