You have a very smart wife I think she’s quite right that there are risks here. I’m fairly certain that at the moment the only way to create one of these hidden tabs is by setting the hidden
flag deep inside the C++ code, and right now this only happens for windows with the isForPrinting
flag set like this:
const bool isForPrinting = aOpenWindowInfo->GetIsForPrinting();
mChild->CreateWindow(parentID, reinterpret_cast<uintptr_t>
(parentBrowsingContext.get()), aChromeFlags, isForPrinting,
&createdID, aCancel);
That’s an internal flag that external JavaScript has no control over, so the only situation in which one will be created is for printing. But you (your wife) has raised a good point and I’ll dig a bit more into it in an upcoming post. I should check whether it’s really the case that nothing else can create these hidden windows. Thanks for the helpful input @rob_kouw!