1 files changed, 3 insertions, 0 deletions

diff --git a/ext/bg/js/settings/popup-preview-frame.js b/ext/bg/js/settings/popup-preview-frame.js
index e900d4e2..890b8c96 100644
--- a/ext/bg/js/settings/popup-preview-frame.js
+++ b/ext/bg/js/settings/popup-preview-frame.js
@@ -27,6 +27,7 @@ class SettingsPopupPreview {
         this.popupShown = false;
         this.themeChangeTimeout = null;
         this.textSource = null;
+        this._targetOrigin = chrome.runtime.getURL('/').replace(/\/$/, '');
     }
 
     static create() {
@@ -97,6 +98,8 @@ class SettingsPopupPreview {
     }
 
     onMessage(e) {
+        if (e.origin !== this._targetOrigin) { return; }
+
         const {action, params} = e.data;
         const handler = SettingsPopupPreview._messageHandlers.get(action);
         if (typeof handler !== 'function') { return; }