Bug 845487 - Dialer responds to cross-origin messages without verifying the source (exploitable).

Including an origin in every postMessage in the Communications app and checking the origin on every message handler as recommended in https://developer.mozilla.org/en-US/docs/DOM/window.postMessage#Security_concerns .