From 3f3d7a0c238a2dfe3e1ca64e4df6199315a0c429 Mon Sep 17 00:00:00 2001
From: Elizabeth Mitchell <lizmitchell@google.com>
Date: Thu, 10 Sep 2026 07:47:13 -0700
Subject: [PATCH] chore(catalog): validate origin in theme-loader postMessage
 handler

PiperOrigin-RevId: 979181733
---
 catalog/stories/theme-loader.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/catalog/stories/theme-loader.ts b/catalog/stories/theme-loader.ts
index eda95aa615..4f5ef80c33 100644
--- a/catalog/stories/theme-loader.ts
+++ b/catalog/stories/theme-loader.ts
@@ -32,6 +32,9 @@ function applyTheme(theme: string) {
  * Apply the theme every time a postdoc pessage is received.
  */
 const onMessage = (e: MessageEvent<string>) => {
+  if (e.origin !== window.location.origin) {
+    return;
+  }
   applyTheme(e.data);
 };