My org has installed a managed package that contains a Home Page component that defines an HTML area. The HTML for the component defines an ifame that gets its source from a Visualforce page that's part of the package.

When I use Chrome to navigate to any page in my org that includes the sidebar (regardless of whether the sidebar is expanded), I get this error message:

Unsafe JavaScript attempt to access frame with URL https://pkgprefix.na5.visual.force.com/apex/VFPage from frame with URL https://na5.salesforce.com/home/home.jsp. Domains, protocols and ports must match.

The error is reported at  SfdcCore.js:150

This happens only in Chrome. (I have version 21.0.1180.89 m, currently the latest version of Chrome.) Firefox and IE are both fine.

When this happens, the Home Page component doesn't display (if the sidebar is expanded), and if I'm on a "view" page (like viewing an Account record), the related lists don't display -- they just sit there empty with the "loading" icon circling endlessly.

Clearly, the domains are different -- the Home Page Component's iframe's src's URL includes the managed package prefix, while the top-level window doesn't. So my question is NOT "What does this error mean?," but rather, "How can I stop it from happening or work around it?"

The Visualforce page that the Home Page Component's iframe loads does contain JavaScript, but nothing that attempts to access the iframe's parent's window. The fact that the error is reported in SfdcCore.js and not in the VF page's custom JavaScript, leads me to think that the problem lies in SfdcCore.js and not in the page's custom JavaScript.

Any thoughts?