Storage access automatically granted for tracker "https://duckduckgo.com"

Question

I hope I didn't miss something somewhere, but I can't get to understand what is exactly happening with what I'm doing.

I'm programming a webapp and in my app I open programmatically a new page to search something in duckduckgo. I'm using the following code window.open("https://duckduckgo.com/?q=something") which is good for me.

This all works fine, but I noticed that when this code is executed, in my console, the following is logged:

Storage access automatically granted for tracker " https://duckduckgo.com " on " http://localhost:8000 ".

I'm wondering what this means.
I'm aware that it's probably not something related to duckduckgo itself, maybe just that they are nice enough to actually log something and be transparent.

What information is exactly shared with an external website when using window.open ? What does this "granting access to the tracker" mean? Where is this log in my console coming from? Can an external site actually execute some javascript code in my current page? This seem strange to me and would sound disastrous for privacy.

Answer 1

So from what I understand from this firefox documentation page (plus a bit of experimenting with window.open ):

When window.open is ran to open https://duckduckgo.com , this allow any tracker from https://duckduckgo.com that would be loaded from localhost now or in the next 30 days, to have access to it's own domain storage (and not only the one of localhost).

The message is logged by firefox itself to inform that you just granted this right to https://duckduckgo.com .

(Thanks a lot Amy for the link that allowed me to learn and answer myself:))

Answer 2

Received scam link which after some quizzes opens in popup one strange link from js side window.open(strange link) . After popup loads it redirects to the instagram and in the console I see same message

storage access automatically granted for origin "strangelink" on "instagram.com"

Is it possible to steal user credentials in that way? PS all tests were made on VM, with fake accounts, so accounts should be safe:-)