You use the postMessage API to send data between them. This process has security risks. Bad scripts send fake messages to your app. Your app accepts them. This leads to XSS attacks. Attackers hijack ...