---
id: "d64b8c8a-35c0-421e-aea7-b853cec364bd"
name: "contentWindow.document from parent"
micro_summary: "Parent-page access to a cross-origin SCORM iframe's contentWindow.document is blocked by the same-origin policy."
status: "discarded"
see_also: []
scope: "Access SCORM iframe content via iframe.contentWindow.document from parent page context"
discard_reason: "Cross-origin SOP blocks iframe contentWindow.document access"
---
Cross-origin SOP blocks compass.billiontoone.com → cdn5.dcbstatic.com. `iframe.contentWindow.document` throws SecurityError from the parent page's CDP context. This applies to all cross-origin iframe access via JavaScript from the parent.