diff --git a/meshchatx/src/frontend/components/nomadnetwork/NomadNetworkPage.vue b/meshchatx/src/frontend/components/nomadnetwork/NomadNetworkPage.vue
index 8427ee8..0aa9323 100644
--- a/meshchatx/src/frontend/components/nomadnetwork/NomadNetworkPage.vue
+++ b/meshchatx/src/frontend/components/nomadnetwork/NomadNetworkPage.vue
@@ -444,6 +444,7 @@
 
 <script>
 import MicronParser from "../../js/MicronParser";
+import LinkUtils from "../../js/LinkUtils";
 import { renderNomadPageByPath } from "../../js/NomadPageRenderer";
 import DialogUtils from "../../js/DialogUtils";
 import WebSocketConnection from "../../js/WebSocketConnection";
@@ -1625,9 +1626,10 @@ export default {
 
             console.log(fieldData);
 
-            // open http urls in new tab
-            if (url.startsWith("http://") || url.startsWith("https://")) {
-                window.open(url, "_blank");
+            const httpHref =
+                typeof url === "string" ? LinkUtils.httpUrlHrefOrNull(url.trim()) : null;
+            if (httpHref) {
+                window.open(httpHref, "_blank", "noopener,noreferrer");
                 return;
             }
 
diff --git a/meshchatx/src/frontend/js/LinkUtils.js b/meshchatx/src/frontend/js/LinkUtils.js
index e9d2264..e2cef07 100644
--- a/meshchatx/src/frontend/js/LinkUtils.js
+++ b/meshchatx/src/frontend/js/LinkUtils.js
@@ -25,6 +25,13 @@ function httpUrlHrefOrNull(core) {
 }
 
 export default class LinkUtils {
+    /**
+     * Returns canonical http(s) href or null if the string is not a safe remote URL.
+     */
+    static httpUrlHrefOrNull(core) {
+        return httpUrlHrefOrNull(core);
+    }
+
     static protectAnchors(text) {
         const anchors = [];
         const protectedText = text.replace(/<a\b[^>]*>[\s\S]*?<\/a>/gi, (anchor) => {
diff --git a/tests/frontend/LinkUtils.test.js b/tests/frontend/LinkUtils.test.js
index d7e973b..10ccdef 100644
--- a/tests/frontend/LinkUtils.test.js
+++ b/tests/frontend/LinkUtils.test.js
@@ -163,4 +163,21 @@ describe("LinkUtils.js", () => {
             expect(Date.now() - start).toBeLessThan(200);
         });
     });
+
+    describe("httpUrlHrefOrNull", () => {
+        it("returns canonical https href", () => {
+            expect(LinkUtils.httpUrlHrefOrNull("https://example.com/path")).toBe(
+                "https://example.com/path"
+            );
+        });
+
+        it("returns null for javascript: payloads that start with https-looking junk", () => {
+            expect(LinkUtils.httpUrlHrefOrNull("https://example.com javascript:alert(1)")).toBeNull();
+        });
+
+        it("returns null for non-http schemes", () => {
+            expect(LinkUtils.httpUrlHrefOrNull("javascript:alert(1)")).toBeNull();
+            expect(LinkUtils.httpUrlHrefOrNull("file:///etc/passwd")).toBeNull();
+        });
+    });
 });