diff --git a/javascript/src/iframe/viamapi-iframe.js b/javascript/src/iframe/viamapi-iframe.js
index 5b7b77151c876a0ce22519bc862ddde366dffb3a..8ba3f419daf1cc65f742947d5992624e86df42a7 100644
--- a/javascript/src/iframe/viamapi-iframe.js
+++ b/javascript/src/iframe/viamapi-iframe.js
@@ -579,8 +579,10 @@ const connection = Penpal.connectToParent({
         throw new Error("Unable to retrieve a list of permitted domains.")
       }
 
-      if (permittedDomains && permittedDomains.length) {
-        const iframeOrigin = document.referrer;
+      const iframeOrigin = document.referrer;
+      if (iframeOrigin && // Empty iframe origins are allowed. This is the case for Roundcube plugin
+          permittedDomains &&
+          permittedDomains.length) {
         let iframeOriginIsPermitted = false;
 
         for (const domain of permittedDomains) {