[RajBhai]

Sounds like a security flaw that browsers honor this.

[kbolino]

Referer is not a security mechanism.

[RajBhai]

I didn't say it was. Browsers display an alert when full-screen mode is activated. Full-screen mode isn't a security feature, but the browser does something the website developer can't control so that users can conclude that something fishy isn't going on. I think the ability for one website to hide that they've redirected to another is a vulnerability.