Do not follow a protocol-relative link in-app

Shipped

September 2, 2026 at 8:37 AM UTC

Author

Kamo

Commit

e6f0577

"//example.com" starts with a slash but is another origin. The in-app branch matched it and would have handed router.push an off-site destination; it belongs in the new-tab branch, where rel=noopener already applies.