Programmatic Click to Open Same-Origin URLs

In Spring '27 and later, when Lightning Web Security (LWS) is enabled, opening same-origin Salesforce URLs in a new tab by using window.open(URL) or window.open(URL, '_blank') results in a LockerSecurityError. Use this recommended programmatic anchor click for same-origin downloads and navigation.

const a = document.createElement('a');
a.href = url;              // /apex/... clears the href denylist
a.target = '_blank';       // or omit for same-tab
a.rel = 'noopener noreferrer';
a.click();                 // keep it detached; do NOT append to body/head

Navigate in the Same Tab

To navigate in the same tab, set the target to a.target= '_top', a.target= '_self', or a.target= '_parent'. For example, a link on the homepage takes the user directly to a record. Alternatively, you can use window.open(url, '_top').

important: Using window.open(URL) without a target defaults to _blank, which in turn results in the LockerSecurityError error.