I don't understand the testcase they provide. It opens a window at https://ssl.comodo.com/ and sends a message to it with `postMessage`. However, the whole point of postMessage is to provide cross-origin communication. Continuing, the message they send is:

     {
        command: "execCode",
        code:    "alert(document.cookie)",
     }

Apparently https://ssl.comodo.com/ used to then proceed to execute that code. However, this is not a vulnerability in the browser, but in that website. Am I missing something? Was Chromodo breaking the `messageEvent.origin` property, breaking same-origin checks in JavaScript? Seems far-fetched.