Solution:

Thanks for playing and having a hard time looking for leaks and other complicated exploits

The intended solution requires user interaction to open a link in new tab: <script>alert(origin)</script><a/href=#>Open me in a New Tab

Sorry if I dissapointed you all and didn't thought it would something this silly, this was reported to a bug bounty program and have received a bounty for it so it's a realistic case scenario