diff --git a/pkgs/dartpad_ui/lib/embed.dart b/pkgs/dartpad_ui/lib/embed.dart
index 1617c25a0..3d067d326 100644
--- a/pkgs/dartpad_ui/lib/embed.dart
+++ b/pkgs/dartpad_ui/lib/embed.dart
@@ -13,6 +13,7 @@ void handleEmbedMessage(AppModel model) {
   web.window.addEventListener(
     'message',
     (web.MessageEvent event) {
+      if (event.source != web.window.parent) return;
       if (event.data case _SourceCodeMessage(:final type?, :final sourceCode?)
           when type == 'sourceCode') {
         if (sourceCode.isNotEmpty) {
diff --git a/pkgs/dartpad_ui/lib/execution/frame.dart b/pkgs/dartpad_ui/lib/execution/frame.dart
index f54df1f58..1a2dadabd 100644
--- a/pkgs/dartpad_ui/lib/execution/frame.dart
+++ b/pkgs/dartpad_ui/lib/execution/frame.dart
@@ -168,6 +168,9 @@ require(["dartpad_main", "dart_sdk"], function(dartpad_main, dart_sdk) {
             if (data['sender'] != 'frame') {
               return;
             }
+            if (event.source == null || _frame.contentWindow != event.source) {
+              return;
+            }
             final type = data['type'] as String?;
 
             if (type == 'stderr') {