iframe page — the sink lives here, in this frame's document.

Its receiving code, plainly: addEventListener('message', e => { if (e.data && e.data.message) document.getElementById('message').innerHTML = e.data.message; }) — no origin check, no payload shape check.