Steps to reproduce the issue

Audit finding

Several links in the Install from Web interface display an icon indicating that they open in a new tab or window.

The icon is hidden from screen readers and other assistive technologies. Its meaning is therefore not conveyed programmatically.

The report states that the issue affects links to the extension directory listing and developer websites.

It suggests using aria-description="Opens in a new window or tab" to expose the behaviour.

User impact

Screen-reader users may not know that activating a link will open a new browser tab or window.

An unexpected change of context can be disorienting, particularly for users who rely on predictable navigation. They may need to return to the Joomla interface after following a link.

Because the icon is hidden, its visual meaning is unavailable to assistive technology. Users receive only the link text, without the additional context provided visually.

Remediation plan

Expose the new-tab or new-window behaviour programmatically

• Convey that affected external links open in a new tab or window through an accessible description or equivalent programmatic relationship
• Consider the report's suggested description: “Opens in a new window or tab”
• Ensure the description is translatable
• Apply the pattern consistently to links to the extension directory and developer websites
• Ensure the icon does not create a duplicate or confusing announcement
• Preserve the link's accessible name and destination
• Verify the behaviour in the actual browser and screen-reader combination
• Check both the link's default state and its focus state
• Ensure the implementation does not rely on visual appearance alone
• Do not add a visible text suffix unless it is part of an agreed design decision; an accessible description may be sufficient

Preconditions

• Use Joomla 6.2 with the Atum administrator template
• Sign in with an account permitted to access the Installer
• Use a test installation where the Install from Web extension list is available
• Record the exact Joomla build, browser name and version, operating system, viewport dimensions, and browser zoom
• Record the screen reader and browser combination if testing announcements
• Start at 100% browser zoom
• Do not install an extension during verification

Steps to reproduce

1. Open the Joomla administrator interface at the site's base URL followed by /administrator/
2. Open System → Install → Extensions
   • Alternatively, navigate to /administrator/index.php?option=com_installer on the same installation
   • Record the navigation labels if they differ in the tested build
3. Open the Install from Web extension list
4. Locate a link that displays the “opens in a new tab/window” icon
5. Record the link text, destination, and whether it opens in a new tab or window
6. Inspect the link and icon using Developer Tools
7. Record the icon's accessibility properties, including aria-hidden, alt, aria-label, and aria-description
8. Record the link's accessible name and description
9. Check whether the new-tab behaviour is exposed programmatically
10. Move keyboard focus to the link
11. Record the screen-reader announcement
12. Capture the link, icon, accessible name, description, and destination
13. Repeat for links to the directory listing and developer website
14. Do not activate the links unless using a test environment where leaving the interface is acceptable

Screen-reader verification

1. Use a screen reader with the browser combination being tested
2. Navigate to an affected external link
3. Record the announced link name, role, and description
4. Check whether the new-tab or new-window behaviour is announced
5. Navigate through the links list and record whether the behaviour remains available
6. Repeat with at least one additional screen reader if available
7. Record the screen-reader name, version, browser, and operating system
8. Do not activate the link during this verification

Verification after remediation

1. Open the Install from Web extension list
2. Locate an affected external link
3. Confirm that its new-tab or new-window behaviour is programmatically conveyed
4. Confirm that the accessible description is translatable
5. Confirm that the link's accessible name remains clear and is not duplicated unnecessarily
6. Move keyboard focus to the link and record the screen-reader announcement
7. Repeat for directory and developer-site links
8. Record the final DOM attributes and screen-reader announcements

Version

6.2

Expected result

External links that open in a new tab or window convey that behaviour programmatically to assistive technology.

Screen-reader users can understand the link's destination and that activating it will open a new tab or window.

The accessible description is translatable and does not duplicate the link's accessible name unnecessarily.

Actual result

The “opens in a new tab/window” icons are hidden from screen readers and other assistive technologies.

The new-tab behaviour is not conveyed programmatically.

The issue affects links to the extension directory listing and developer websites.

The current Joomla 6.2 build needs to be checked to establish whether the issue persists and which links are affected.

What device were you using? (eg, phone, laptop)

Desktop web

What web browser were you using? (eg, Chrome, Safari)

Chrome, Firefox, Edge, Safari

Assistive Technology?

VoiceOver, JAWS, NVDA

Additional Comments

The browser and assistive-technology entries above are carried forward from the original issue and do not represent a new verification of every combination against Joomla 6.2.

Development is the responsibility tag in the original report.

The report's suggested aria-description is one possible approach. Verify support and announcement behaviour in the intended browser and screen-reader combinations, and use an equivalent accessible description mechanism where appropriate.

This issue concerns the new-tab indication on external links. It does not require changing the link destinations or whether they open in a new tab.

MS2a is proposed for the shared external-link icon pattern, with MS3b covering the documented Installer integration.