{"record":{"id":"c5502e42caaa6b15","repo":"vuejs/devtools-v6","slug":"vue-devtools-failed-to-send-message-to-parent-wi","errorCode":null,"errorMessage":"[Vue Devtools] Failed to send message to parent window","messagePattern":"\\[Vue Devtools\\] Failed to send message to parent window","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/app-backend-core/src/hook.ts","lineNumber":82,"sourceCode":"    }\n    return\n  }\n\n  let hook\n\n  if (isIframe) {\n    const sendToParent = (cb) => {\n      try {\n        const hook = (window.parent as any).__VUE_DEVTOOLS_GLOBAL_HOOK__\n        if (hook) {\n          return cb(hook)\n        }\n        else {\n          console.warn('[Vue Devtools] No hook in parent window')\n        }\n      }\n      catch (e) {\n        console.warn('[Vue Devtools] Failed to send message to parent window', e)\n      }\n    }\n\n    hook = {\n      devtoolsVersion,\n      // eslint-disable-next-line accessor-pairs\n      set Vue(value) {\n        sendToParent((hook) => {\n          hook.Vue = value\n        })\n      },\n\n      // eslint-disable-next-line accessor-pairs\n      set enabled(value) {\n        sendToParent((hook) => {\n          hook.enabled = value\n        })\n      },","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/vuejs/devtools-v6/blob/dd2ab5d4275187cbd81952a2a3d53c335643c1f4/packages/app-backend-core/src/hook.ts#L64-L100","documentation":"When accessing `window.parent.__VUE_DEVTOOLS_GLOBAL_HOOK__` itself throws (most commonly a cross-origin parent, where the property access violates the same-origin policy), sendToParent catches the exception and logs this warning with the error. The message to the parent is lost. Like [2], it is a logged warning, not a thrown error.","triggerScenarios":"Any sendToParent call while the app runs in a cross-origin iframe: evaluating `window.parent.__VUE_DEVTOOLS_GLOBAL_HOOK__` throws a SecurityError, which lands in this catch block. Also any other unexpected exception raised during parent-window access.","commonSituations":"Vue app embedded in a third-party cross-origin iframe (ad frames, hosted previews, CodeSandbox/StackBlitz style embeds); browser privacy extensions blocking cross-origin access; parent page on a different domain than the app.","solutions":["Serve the app from the same origin as the parent page, or inject the devtools hook script into the parent document so no cross-origin access is needed.","Use a postMessage-based bridge instead of direct parent-window hook access for cross-origin embedding.","Confirm the iframe isn't sandboxed in a way that blocks parent access; adjust sandbox attributes if you control the host.","Ignore the warning if devtools integration inside embedded cross-origin frames is not required."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"function canAccessParent() {\n  try { void window.parent.location.href; return true } catch { return false }\n}","typeGuard":null,"tryCatchPattern":"try {\n  sendToParent(fn)\n} catch (e) {\n  console.warn('[Vue Devtools] Failed to send message to parent window', e)\n  // fall back to local hook or postMessage channel\n}","preventionTips":["Serve iframe apps same-origin with the parent when possible","Use a postMessage bridge for cross-origin embedding instead of direct hook access","Check sandbox attributes if the iframe is sandboxed"],"tags":["iframe","cross-origin","security","hook"],"backgroundTag":"cross-origin-access-denied","analyzedSha":"dd2ab5d4275187cbd81952a2a3d53c335643c1f4","analyzedAt":"2026-08-31T12:41:59.822Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}