Why the player opens extra tabs, and how to stop it

What is actually happening

The video is not served by this site. Each source is a separate third-party page embedded in an iframe. Some of those pages run ad scripts that call window.open(), try to navigate the top window, or place a transparent layer over the play button so a tap hits their ad instead.

Those calls happen inside the provider’s document. The catalogue, the search page and the watchlist never call window.open — the frame is the only thing that can.

What the browser does and does not allow

There is exactly one browser feature that stops a frame from opening windows: the iframe sandbox attribute without allow-popups. It also breaks playback here. Every host this site ships probes for a sandbox on mount — window.frameElement, a document.domain assignment and a plugin object load test — and answers a sandboxed frame with an “Iframe Sandbox Detected” wall instead of the video. A sandbox that plays nothing protects nothing.

A parent page also cannot close a window that its iframe opened: the popup’s window handle belongs to the caller, and the caller is cross-origin. Serving the provider’s HTML through our own server to inject a window.open blocker was tested; the host application did not render through the proxy, so it is not shipped.

What this site does instead

The player removes the easy paths and makes the remaining one survivable:

• Source URLs are signed server-side. The frame points at /api/play/<token>; no provider hostname appears in the page source, the inspector or a copied link.
• No source is ever offered as an outbound “open in a new tab” link, so the provider domain is never displayed to a visitor.
• Hosts known to open pop-unders ask once before the frame mounts, and a “use a clean source instead” button is offered next to the warning.
• A host that does pop is remembered for 14 days; the next visit starts on a source that has not popped for you (or on the same source behind the warning).
• Exit, fullscreen, reload and episode navigation stay in this page, so an ad tab never costs you the film.

One correction worth knowing

Earlier builds treated any window blur as an ad tab. Clicking into a cross-origin frame also fires blur on the parent while the tab stays visible — focus simply moved into the video. That produced false “ad tab” notices and source jumps on the first play. The player now ignores a blur when the focused element is its own frame, and only reacts when focus leaves the page for a real new window.

If a tab still opens

Close it and press play again; playback continues in this page. Switch to another source if it keeps happening. Nothing you change in Chrome or Safari will stop a provider page from calling window.open — the call is made by that page, not by this site.