Always provide a specific targetOrigin, not *, if you know where the other window's document should be located. Failing to provide a specific target discloses the data you send to any interested malicious site.

I wonder whether that is relevant to us?

Further down it says

It is not possible for content or web context scripts to specify a targetOrigin to communicate directly with an extension (either the background script or a content script).

I can probably set it to document.location.href but not sure what that'll gain us?

What we could also do which I just realized is that we could send a CustomEvent to the window instead of using postMessage
Basically what we did before except without a wrapper div as while the JavaScript contexts are different, events posted to window are visible from the content script.

In D23568#522065, @broulik wrote:

What we could also do which I just realized is that we could send a CustomEvent to the window instead of using postMessage
Basically what we did before except without a wrapper div as while the JavaScript contexts are different, events posted to window are visible from the content script.

That does sound much nicer actually. Looking at the documentation it seems like that's intended as the main way for communication with extensions even.