The vulnerability stems from missing rel="noopener" attributes when setting target="_blank". The commit patching this vulnerability specifically modifies two areas: 1) The targetLinksToNewWindow function that processes all links, and 2) The HTML template literals generating interaction buttons. Both locations initially created links with target="_blank" without security attributes, making them vulnerable to window.opener exploitation. The named function targetLinksToNewWindow is explicitly vulnerable, while the interaction link generation (though part of inline template construction) represents a distinct vulnerable code path that was also patched.