diff --git a/addons/mail/static/src/js/utils.js b/addons/mail/static/src/js/utils.js
index 25e327b0428..4c9fdd8d20e 100644
--- a/addons/mail/static/src/js/utils.js
+++ b/addons/mail/static/src/js/utils.js
@@ -33,6 +33,9 @@ function linkify(text, attrs) {
     if (attrs.target === undefined) {
         attrs.target = '_blank';
     }
+    if (attrs.target === '_blank') {
+      attrs.rel = 'noreferrer noopener';
+    }
     attrs = _.map(attrs, function (value, key) {
         return key + '="' + _.escape(value) + '"';
     }).join(' ');
diff --git a/addons/website_twitter/static/src/js/website.twitter.animation.js b/addons/website_twitter/static/src/js/website.twitter.animation.js
index 3bea076d7bd..295ae199868 100644
--- a/addons/website_twitter/static/src/js/website.twitter.animation.js
+++ b/addons/website_twitter/static/src/js/website.twitter.animation.js
@@ -74,6 +74,7 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
                         text: text,
                         href: url,
                         target: '_blank',
+                        rel: 'noreferrer noopener',
                     });
                     return c.prop('outerHTML');
                 }
diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py
index f9a5cfa67cf..aa2552f8356 100644
--- a/odoo/tools/mail.py
+++ b/odoo/tools/mail.py
@@ -261,7 +261,7 @@ def html_keep_url(text):
     link_tags = re.compile(r"""(?<!["'])((ftp|http|https):\/\/(\w+:{0,1}\w*@)?([^\s<"']+)(:[0-9]+)?(\/|\/([^\s<"']))?)(?![^\s<"']*["']|[^\s<"']*</a>)""")
     for item in re.finditer(link_tags, text):
         final += text[idx:item.start()]
-        final += '<a href="%s" target="_blank">%s</a>' % (item.group(0), item.group(0))
+        final += '<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>' % (item.group(0), item.group(0))
         idx = item.end()
     final += text[idx:]
     return final