Sessions are typically stored in cookies, and how cookies are shared between tabs / windows is browser and configuration dependent, but typically they are shared, and
you should assume that all windows / tabs from a given client will share the same cookies.
The solution is to NOT use cookies to store session ids. This requires work - including re-writing every URL so that it encodes the session id when needed (you should do this anyway) and re-configuring the application container to not use cookies. To learn more you should be able to google for
Java servlet session management, or something similar, to get details.