---
schema_version: "1"
id: d003b70aa0b441aa90255ab121fea1b9f361d75fefa30f224630f1dd08c30170
title: Use Programmatic Anchor Clicks for Same-Origin URLs
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_lws_prog_click.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_lws_prog_click.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1017b55a66e97866a77d7e74e9b23108d6062a4d84480741aebc1460ccb4697b
description: In version Spring '27 and later, when Lightning Web Security (LWS) is enabled, opening the same-origin Salesforce URLs in a new tab via window.open(url), or with '_blank' throws a LockerSecurityError. Replace these calls with a detached programmatic anchor click to safely handle same-origin navigation and downloads.
products:
  - Cross Cloud
release: "264"
---
# Use Programmatic Anchor Clicks for Same-Origin URLs

In version Spring '27 and later, when Lightning Web Security (LWS) is enabled, opening the same-origin Salesforce URLs in a new tab via `window.open(url)`, or with `'_blank'` throws a `LockerSecurityError`. Replace these calls with a detached programmatic anchor click to safely handle same-origin navigation and downloads.

**Where:** This change applies to Lightning Web Security (LWS) starting from Spring '27.

**Why:** Attempting to open same-origin Salesforce URLs in a new tab using `window.open(URL)` , or with `window.open(URL, '_blank')` throws a `LockerSecurityError`.

**How:**To perform same-origin downloads or open same-origin links in a new tab, replace `window.open()` calls with a programmatically created, detached `a` element.

```java
const a = document.createElement('a');
      a.href = url;              // Clears the href denylist (e.g., /apex/...)
      a.target = '_blank';       // Use '_blank' for new tab or omit for same tab
      a.rel = 'noopener noreferrer';
      a.click();                 // Keep detached; DO NOT append to body or head
```

If you need to navigate within the same tab, you can set `a.target` to `'_top'`, `'_self'`, or `'_parent'`, or continue using `window.open(url, '_top')`.