The window.postMessage() method safely enables cross-origin communication between Window objects; e.g., between a page and a pop-up that it spawned, or between a page and an iframe embedded within it.
Cross-document messaging (aka postMessage) is an API introduced in the WHATWG HTML5 draft specification, allowing documents to communicate with one another across different origins, or source domains. Prior to HTML5, Web browsers disallowed cross-site scripting, to protect against security attacks.
See MDN Window.postMessage() API Reference
