Windows, tabs and frames talk across origins through postMessage — and both mouths of the bridge matter: the receiver validates event.origin, the sender pins targetOrigin to the expected parent. A missing check on either side turns messages into payloads.