This PoC demonstrates that the AdMessageHandler in coolblue.nl accepts CLICK_EVENT postMessages from any origin without validation.