diff --git a/CHANGELOG.md b/CHANGELOG.md
index 54445159..2ac8aaca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@
 
 - Added `filesystem.NewWriter(key, opts)` low-level helper to allow direct file create from an `io.Reader` value.
 
+- Added `Cross-Origin-Opener-Policy:same-origin` to the default security response headers.
+    _This is just an extra precaution to prevent tab-nabbing in case custom UI plugins use `target="_blank"` without `rel="noopener"`._
+
 
 ## v0.39.11 (WIP)
 
diff --git a/apis/middlewares.go b/apis/middlewares.go
index c4df9aef..d033f237 100644
--- a/apis/middlewares.go
+++ b/apis/middlewares.go
@@ -293,6 +293,7 @@ func securityHeaders() *hook.Handler[*core.RequestEvent] {
 			e.Response.Header().Set("X-XSS-Protection", "1; mode=block")
 			e.Response.Header().Set("X-Content-Type-Options", "nosniff")
 			e.Response.Header().Set("X-Frame-Options", "SAMEORIGIN")
+			e.Response.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
 
 			// @todo consider a default HSTS?
 			// (see also https://webkit.org/blog/8146/protecting-against-hsts-abuse/)