diff --git a/src/main/resources/META-INF/resources/primefaces/schedule/1-schedule.js b/src/main/resources/META-INF/resources/primefaces/schedule/1-schedule.js
index <HASH>..<HASH> 100644
--- a/src/main/resources/META-INF/resources/primefaces/schedule/1-schedule.js
+++ b/src/main/resources/META-INF/resources/primefaces/schedule/1-schedule.js
@@ -78,7 +78,9 @@ PrimeFaces.widget.Schedule = PrimeFaces.widget.DeferredWidget.extend({
 
         this.cfg.eventClick = function(calEvent, jsEvent, view) {
             if (calEvent.url) {
-                window.open(calEvent.url, $this.cfg.urlTarget);
+                var targetWindow = window.open('', $this.cfg.urlTarget);
+                targetWindow.opener = null;
+                targetWindow.location = calEvent.url;
                 return false;
             }
fix: schedule: URL events enable phishing attacks (#<I>)