The root cause is that the init message first sent to an extension host worker might be preceded with messagse sent by various browser extensions, since they have access to the DOM and can (and will) freely call postMessage on iframes they find.