Can a page really change on its own?

A page can redirect itself, including after a delay, and change its title and icon: these are ordinary web functions. The attack doesn't exploit a flaw, it exploits the fact that we don't re-read the address of a tab that's already open.

How do I protect myself without thinking about it all the time?

Two habits are enough: close tabs of sensitive services after use, and never log in from an already-open tab without re-reading the address. A password manager helps, since it will refuse to fill in a form on a domain that isn't the right one.

Tabnabbing (swapped tab)

In plain terms

A tab left open changes content while you're looking elsewhere. Coming back to it, you find a login page — and you log in, since it was you who opened that tab.

Definition

Tabnabbing consists of changing the content of an inactive tab to display a fake login page in it, exploiting the fact that users attribute to a tab the origin it had when they opened it.

How it works

The attack targets a habit rather than a flaw: we leave tabs open for hours, and when we come back to them we don't re-read the address — we already decided, when opening it, what that tab contains. A page left inactive can detect that inactivity and replace itself with an imitation of a common service, complete with matching icon and title, since both are chosen by the page. On returning, the user finds a login request that looks like it comes from an expired session, a routine situation and therefore not very suspicious. A variant relies on a link opened in a new tab: the arriving page can, in some cases, retain the ability to redirect the one you came from — so it's not the opened page that changes, but the one you left behind.

Warning signs

Login request on a tab you hadn't left
Tab whose icon or title has changed since you opened it
Session expiration announced when you were active on the site shortly before
Tab address different from the site you thought you had there
Password manager no longer offering to fill in a form it used to fill in

How to verify

Re-read the address bar when returning to a tab, exactly as if it had just been opened: that one habit alone neutralizes the attack. Faced with an unexpected login request, close the tab and reopen the service from a bookmark rather than logging in where you are.

What to do

Don't leave tabs for sensitive services open indefinitely, and be wary of login requests you didn't trigger. An up-to-date browser limits several variants of this behavior.

If it already happened

Change the service's password from a session opened by your own means, then revoke active sessions. Check the account's recovery email and phone number, as well as forwarding rules if it's a mailbox.

Frequently asked questions

Can a page really change on its own?: A page can redirect itself, including after a delay, and change its title and icon: these are ordinary web functions. The attack doesn't exploit a flaw, it exploits the fact that we don't re-read the address of a tab that's already open.
How do I protect myself without thinking about it all the time?: Two habits are enough: close tabs of sensitive services after use, and never log in from an already-open tab without re-reading the address. A password manager helps, since it will refuse to fill in a form on a domain that isn't the right one.

Official sources

Cybermalveillance.gouv.fr — Phishing (French government cybersecurity assistance service)

This article is part of the Website and browser attacks family. Last updated: 2026-09-02.