[tyingq]

It maps back to window.postMessage. There's a security concerns section on Mozilla's docs: https://developer.mozilla.org/en-US/docs/Web/API/Window/post...

All boils down the sender using a specific target, and the receiver remembering to check the origin.