chromium/components/test/data/subresource_filter/window_open_spoof_click.html

<a href = "https://www.google.com" id='target'>target</a>
<script>
// This document can exist in both toplevel and subframe contexts. In the case
// of the latter, this function is called in response to any postMessage, and
// responds in turn with an empty postMessage.
function openWindow(e) {
  var evt = new MouseEvent("click", {
    view : window,
    bubbles : true,
    cancelable : true,
    shiftKey : true,
  });
  document.getElementById('target').dispatchEvent(evt);
  if (e) {
    e.source.postMessage('', e.origin);
  }
  return true;
}
window.addEventListener('message', openWindow);
</script>