From 649d141527488281e75d9f67e380ee522426817b Mon Sep 17 00:00:00 2001
From: Mariana Sinisterra <mariana.data@outlook.com>
Date: Tue, 24 Feb 2026 07:56:08 -0500
Subject: [PATCH] fix(ui): prevent tabnabbing in chat images (#18685)

* UI: prevent tabnabbing in chat images

* ui: remove comment from image open helper

---------

Co-authored-by: Shakker <shakkerdroid@gmail.com>
---
 ui/src/ui/chat/grouped-render.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ui/src/ui/chat/grouped-render.ts b/ui/src/ui/chat/grouped-render.ts
index 7c36713c3c0..4726596c6e1 100644
--- a/ui/src/ui/chat/grouped-render.ts
+++ b/ui/src/ui/chat/grouped-render.ts
@@ -200,6 +200,13 @@ function renderMessageImages(images: ImageBlock[]) {
     return nothing;
   }
 
+  const openImage = (url: string) => {
+    const opened = window.open(url, "_blank", "noopener,noreferrer");
+    if (opened) {
+      opened.opener = null;
+    }
+  };
+
   return html`
     <div class="chat-message-images">
       ${images.map(
@@ -208,7 +215,7 @@ function renderMessageImages(images: ImageBlock[]) {
             src=${img.url}
             alt=${img.alt ?? "Attached image"}
             class="chat-message-image"
-            @click=${() => window.open(img.url, "_blank")}
+            @click=${() => openImage(img.url)}
           />
         `,
       )}