It probably means accessing another contexts' global object directly via an iframe (or child window), which works for matching domains and throws a security exception otherwise.
Right... I suppose the author presupposed you have a handle on the other window, which you can only get from window.open(), <iframe>, etc.
Makes me wonder what kind of race conditions can happen between contexts sharing global objects. Are they guaranteed to behave as if they were one context? i.e., single threaded?
I have vague memories of opening new windows with window.open to fill out a form and communicating state back to the parent window. I also did it with iframes, probably to upload a form without a page refresh.
Normally, scripts on different pages are allowed to access each other if and only if the pages that executed them are at locations with the same protocol (usually both https), port number (443 being the default for https), and host (modulo document.domain being set by both pages to the same value).
https://developer.mozilla.org/en-US/docs/Web/API/Window/post...
What access is it talking about? I get the feeling they are talking about parent-child windows.