At least in chrome, you get the warning: > Blocked a frame with origin "https://www.google.com" https://www.google.com" from accessing a frame with origin "htt

At least in chrome, you get the warning: > Blocked a frame with origin "https://www.google.com" https://www.google.com" from accessing a frame with origin "https://news.ycombinator.com" https://news.ycombinator.com". Protocols, domains, and ports must match. When executing window.opener.location = 'javascript:alert(1);'