So my question was, if you are technically allowed to keep looking via JS for changing content in that iframe from outside.

You are not looking into the iframe for changes. The iframe is sending a message when it detects an event within itself.

Cross-origin manipulation is not allowed but cross-origin messaging is.

tpartner wrote: You are not looking into the iframe for changes. The iframe is sending a message when it detects an event within itself.

I understand you approach, but I'm asking for the other way around (e.g. in case you cannot add JS code to the iframe).

jelo wrote: I understand you approach, but I'm asking for the other way around (e.g. in case you cannot add JS code to the iframe).

You can only access events within the iframe if it has the same origin (domain). In this case, I assume the origins are different.