Cross-origin frame access errors in browser console from conversations-embed.js

[MrL]

Subject: Cross-origin frame access errors in browser console from conversations-embed.js

Product: HubSpot Chat Widget / Conversations

Severity: Low (cosmetic/console noise, functionality not affected)

Environment:
- Website: <redacted>
- Browser: Safari (also reproducible in Chrome/Firefox)
- HubSpot tracking code version: Current (as of January 2026)

Description:

The HubSpot chat widget and tracking scripts generate repeated cross-origin security errors in the browser console on every page load. While the widget appears to function correctly, these errors create console noise that makes debugging other issues difficult and may concern security-conscious users or developers.

Console Errors:

[Error] Blocked a frame with origin "<redacted>" from accessing a frame with origin "https://app.hubspot.com". Protocols, domains, and ports must match.
handleWindowResize (conversations-embed.js:1:17026)

[Error] Blocked a frame with origin "<redacted>" from accessing a frame with origin "https://app.hubspot.com". Protocols, domains, and ports must match.
handleStoreMessagesCookie (conversations-embed.js:1:16275)
handleMessage (conversations-embed.js:1:28361)

[Error] Blocked a frame with origin "<redacted>" from accessing a frame with origin "https://app.hubspot.com". Protocols, domains, and ports must match.
handleIframeLoad (conversations-embed.js:1:13941)

Additional Warning:

[Warning] [quick-fetch] quickFetchScript was not included or running in Node.js environment. Falling back to stubbed implementation. (visitor.js, line 1)

Steps to Reproduce:

1. Add HubSpot tracking code to any website
2. Enable the HubSpot chat widget
3. Load any page on the website
4. Open browser Developer Tools -> Console
5. Observe the cross-origin frame access errors

Root Cause Analysis:

The errors originate from these functions in conversations-embed.js:
- handleWindowResize (line 17026)
- handleStoreMessagesCookie (line 16275)
- handleIframeLoad (line 13941)

These functions appear to be attempting direct DOM access to the parent frame from within the HubSpot iframe, which violates the browser's Same-Origin Policy. This is blocked regardless of Content-Security-Policy settings because CSP controls resource loading, not cross-origin JavaScript access.

Expected Behavior:

HubSpot scripts should use postMessage() API exclusively for all cross-origin communication and should include proper error handling with try/catch blocks to prevent console errors when direct frame access is (correctly) blocked by the browser.

Suggested Fix:

1. Wrap cross-origin frame access attempts in try/catch blocks
2. Use feature detection before attempting direct frame access
3. Rely solely on postMessage() for cross-origin communication

Example pattern:

// Instead of:
parent.document.something; // Throws error

// Use:
try {
// Attempt if same-origin (will fail silently if cross-origin)
if (window.parent !== window) {
parent.postMessage({ type: 'resize', data: ... }, '*');
}
} catch (e) {
// Already using postMessage fallback, no error logged
}

Impact:

- Console pollution on every page load
- Difficulty debugging legitimate website issues
- May trigger alerts in security monitoring tools
- Poor developer experience

Workaround:

None available on the customer side. This requires a fix in HubSpot's JavaScript code.

---------------------------------------------------------------------

Report prepared: January 22, 2026

[Victor_Becerra]

Hi @MrL Thank you for posting!

I'm gonna tag some subject matter experts that can be helpful here:

Hello @LauraMarie @d-lupo @Jonathan_Vaz any ideas on how to solve this?
Thanks!

Victor