PostMessage example

postmessage_example.js

function openChild() {child = window.open('/', 'popup', 'height=300px, width=500px');}

function sendMessage(input, child){
    let msg=input;
    // In production, DO NOT use '*', use toe target domain
    child.postMessage(msg,'*')// child is the targetWindow
    child.focus();
}

openChild()
sendMessage("<img src=x onerror=alert(1)>",child);

 <iframe src="//vulnerable-website" onload="this.contentWindow.postMessage('alert(1)','*')">