Could this banner heading steal your data? <script>window.open('https://owasp.org/www-community/attacks/xss', '_blank');</script>