Use Programmatic Anchor Clicks for Same-Origin URLs

In version Spring '27 and later, when Lightning Web Security (LWS) is enabled, opening the same-origin Salesforce URLs in a new tab via window.open(url), or with '_blank' throws a LockerSecurityError. Replace these calls with a detached programmatic anchor click to safely handle same-origin navigation and downloads.

Where: This change applies to Lightning Web Security (LWS) starting from Spring '27.

Why: Attempting to open same-origin Salesforce URLs in a new tab using window.open(URL) , or with window.open(URL, '_blank') throws a LockerSecurityError.

How:To perform same-origin downloads or open same-origin links in a new tab, replace window.open() calls with a programmatically created, detached a element.

const a = document.createElement('a');
      a.href = url;              // Clears the href denylist (e.g., /apex/...)
      a.target = '_blank';       // Use '_blank' for new tab or omit for same tab
      a.rel = 'noopener noreferrer';
      a.click();                 // Keep detached; DO NOT append to body or head

If you need to navigate within the same tab, you can set a.target to '_top', '_self', or '_parent', or continue using window.open(url, '_top').