If you use the target="_blank" attribute on a link, and do not accompany it with a rel="noopener" attribute, you are leaving your users open to a very simple phishing attack.

Imagine the following is user-generated content on your website: Clicking the above link opens malicious.html in a new tab (using target=_blank). By itself, that’s not very exciting.
However, the malicious.html document in this new tab has a window.opener which points to the window of the HTML document you’re viewing right now, i.e. index.html. This means that once the user clicks the link, malicious.html has full control over this document’s window object!
Note that this also works when index.html and malicious.html are on different origins — window.opener.location is accessible across origins!