Prior to the Summer 17 release, my lightning component worked fine. After the release, I changed my API version for my VF page and lightning components to v40.

Now when I try to load jQuery, I receive

Uncaught SecurityError: Blocked a frame with origin 
"https://<myInstance>.visual.force.com" from accessing a cross-origin 
frame. throws at https://<myInstance>.visual.force.com/auraFW/javascript/fQ2T-

My setup is a Lightning Component in a Lightning App in a Visualforce page added to the Salesforce console.

Currently, my component is just

<aura:component access="global">
   <ltng:require scripts="{!$Resource.jQuery}"/>

With jQuery version 2.2.4 as the resouce.

  • Setting API v40 and above will enable LockerService for the page/component starting in the Summer '17 release: releasenotes.docs.salesforce.com/en-us/summer17/release-notes/…
    – Kalin
    May 8, 2017 at 16:30
  • @Kalin: yes, I've set the api version to v40 as I would like to try and conform to the new LockerService standard. If I cannot resolve this issue, then I'll need to rollback to v39. Prior to the Summer 17 release, I had the LockerService critical update enabled.
    – Ryan G.
    May 8, 2017 at 16:45

1 Answer 1


For anyone who may find this later. The solution was to use jquery-3.2.1. jQuery 2.2.4 seems to try and modify the DOM outside of its scope.

  • Thanks for the update. I didn't get around to testing it yet, but am surprised since I just found 2.2.4 was listed in this Blog post as confirmed to work with LockerService. Wonder what changed or what was tested for this blog: developer.salesforce.com/blogs/developer-relations/2017/02/…
    – Kalin
    May 8, 2017 at 19:15
  • It only seems to be an issue when embedded within the service cloud console. If I load the VF page outside of the console, the page loads fine.
    – Ryan G.
    May 9, 2017 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .