diff --git a/src/action.js b/src/action.js
index edeecb5e86..f4f6264765 100644
--- a/src/action.js
+++ b/src/action.js
@@ -133,7 +133,7 @@
                 Sao.Action.exec_report(params);
                 return;
             case 'ir.action.url':
-                window.open(action.url, '_blank');
+                window.open(action.url, '_blank', 'noreferrer,noopener');
                 return;
         }
     };
diff --git a/src/sao.js b/src/sao.js
index b81a17dce1..3282262f94 100644
--- a/src/sao.js
+++ b/src/sao.js
@@ -530,7 +530,7 @@ var Sao = {};
                 return;
             }
             if (url) {
-                window.open(url, '_blank');
+                window.open(url, '_blank', 'noreferrer,noopener');
             }
         }
 
diff --git a/src/view/form.js b/src/view/form.js
index dfb6f708cd..901f5e727b 100644
--- a/src/view/form.js
+++ b/src/view/form.js
@@ -4037,7 +4037,7 @@ function eval_pyson(value){
             });
             Sao.common.selection(Sao.i18n.gettext("Choose a language"), options)
             .done(function(language) {
-                window.open(this.uri(language), '_blank');
+                window.open(this.uri(language), '_blank', 'noreferrer,noopener');
             }.bind(this));
         },
     });