editor.js

// Editor
const iframe = document.querySelector("iframe").contextWindow
const VIEWING_DOMAIN = "https://viewing.example.com"

function runJS(codeString, args, cb) {
  const id = rememberCallback(cb)
  iframe.postMessage({codeString, args, id}, EDITOR_DOMAIN)
}

window.addEventListener("message", function({id, result}, origin, source) {
  // id, and result, are NOT trusted.
  if(origin != VIEWING_DOMAIN) return;
  getCallback(id)(result)
})

viewer.js

// Viewer
const EDITOR_DOMAIN = "https://editing.example.com"

window.addEventListener("message", function({codeString, args, id}, origin, source) {
  if(origin != EDITOR_DOMAIN) return;
  
  const func = eval("function() {" + codeString + "}") // or however you do it currently
  const evaluated = func(...args)
  source.postMessage({result: evaluated.toString(), id})
})