# targetOrigin mismatch is a silent discard, not a throw

Lesson 1 quiz: A, B, C, E correct; D wrong. D is “send with `targetOrigin: https://widget.example` while the iframe is now `https://other.example`.” The browser discards the data and does not throw. The likely mix-up is with a document peek: a read on a different origin throws `SecurityError`; a send with a wrong `targetOrigin` does not. Next handle/postMessage work should keep those two outcomes separate.