When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites.
It's equally important to check the origin when receiving a message to prevent other sites from triggering our scripts.
But, if we're just expecting to do this on our own domain, is there anything wrong with:
targetWindow.postMessage({message}, window.origin);
--
window.addEventListener("message", e => {
if (e.origin == window.origin){
//Trigger something
}
});