diff --git a/addons/web/static/src/webclient/actions/action_service.js b/addons/web/static/src/webclient/actions/action_service.js
index bb06fbd018b..1936c0775d2 100644
--- a/addons/web/static/src/webclient/actions/action_service.js
+++ b/addons/web/static/src/webclient/actions/action_service.js
@@ -818,6 +818,9 @@ function makeActionManager(env) {
      * @param {ActionOptions} options
      */
     function _executeActURLAction(action, options) {
+        let url = action.url;
+        if (url && !(url.startsWith('http') || url.startsWith('/')))
+            url = '/' + url;
         if (action.target === "self") {
             let willUnload = false;
             const onUnload = () => {
@@ -825,13 +828,13 @@ function makeActionManager(env) {
             };
             browser.addEventListener("beforeunload", onUnload);
             env.services.ui.block();
-            browser.location.assign(action.url);
+            browser.location.assign(url);
             browser.removeEventListener("beforeunload", onUnload);
             if (!willUnload) {
                 env.services.ui.unblock();
             }
         } else {
-            const w = browser.open(action.url, "_blank");
+            const w = browser.open(url, "_blank", "noreferrer");
             if (!w || w.closed || typeof w.closed === "undefined") {
                 const msg = env._t(
                     "A popup window has been blocked. You may need to change your " +
diff --git a/addons/web/static/tests/webclient/actions/url_action_tests.js b/addons/web/static/tests/webclient/actions/url_action_tests.js
index 77586ab626b..58819e90d01 100644
--- a/addons/web/static/tests/webclient/actions/url_action_tests.js
+++ b/addons/web/static/tests/webclient/actions/url_action_tests.js
@@ -57,7 +57,10 @@ QUnit.module("ActionManager", (hooks) => {
     QUnit.test("execute an 'ir.actions.act_url' action with onClose option", async (assert) => {
         setupWebClientRegistries();
         patchWithCleanup(browser, {
-            open: () => assert.step("browser open"),
+            open: (url, target, argument) => {
+                assert.step("browser open");
+                assert.strictEqual(argument, "noreferrer");
+            },
         });
         const env = await makeTestEnv({ serverData });
         const options = {
@@ -66,4 +69,21 @@ QUnit.module("ActionManager", (hooks) => {
         await doAction(env, { type: "ir.actions.act_url" }, options);
         assert.verifySteps(["browser open", "onClose"]);
     });
+    
+    QUnit.test("execute an 'ir.actions.act_url' action with url javascript:", async (assert) => {
+        assert.expect(2);
+        patchWithCleanup(browser.location, {
+            assign: (url) => {
+                assert.step(url);
+            },
+        });
+        setupWebClientRegistries();
+        const env = await makeTestEnv({ serverData });
+        await doAction(env, {
+            type: "ir.actions.act_url",
+            target: "self",
+            url: "javascript:alert()",
+        });
+        assert.verifySteps(["/javascript:alert()"]);
+    });
 });