diff --git a/android/src/main/java/com/reactnativecommunity/webview/RNCWebView.java b/android/src/main/java/com/reactnativecommunity/webview/RNCWebView.java
index 80c68034b193a47bedb56ca527352de9548e8ac6..977c068a74c88c0322fca2a4bbffab8bc1ba719d 100644
--- a/android/src/main/java/com/reactnativecommunity/webview/RNCWebView.java
+++ b/android/src/main/java/com/reactnativecommunity/webview/RNCWebView.java
@@ -253,6 +253,12 @@ public class RNCWebView extends WebView implements LifecycleEventListener {
             this.bridgeListener = new WebViewCompat.WebMessageListener() {
               @Override
               public void onPostMessage(@NonNull WebView view, @NonNull WebMessageCompat message, @NonNull Uri sourceOrigin, boolean isMainFrame, @NonNull JavaScriptReplyProxy replyProxy) {
+                // Orca: only the page's own document may message the app. A subframe (for example agent
+                // HTML in a sandboxed iframe) reaches this listener too, and getData() throws for a
+                // non-string message.
+                if (!isMainFrame || message.getType() != WebMessageCompat.TYPE_STRING) {
+                  return;
+                }
                 RNCWebView.this.onMessage(message.getData(), sourceOrigin.toString());
               }
             };
diff --git a/apple/RNCWebViewImpl.m b/apple/RNCWebViewImpl.m
index 7f5c24d6e2cfb26eddbc513bf17a81c24a7273e2..d70cb58a3c81cb22bd549a2c37340ba53853cfcf 100644
--- a/apple/RNCWebViewImpl.m
+++ b/apple/RNCWebViewImpl.m
@@ -776,12 +776,21 @@ - (void)userContentController:(WKUserContentController *)userContentController
       didReceiveScriptMessage:(WKScriptMessage *)message
 {
   if ([message.name isEqualToString:HistoryShimName]) {
+    // Orca: the history shim is the page's own script; a subframe or non-string body is not it.
+    if (!message.frameInfo.isMainFrame || ![message.body isKindOfClass:[NSString class]]) {
+      return;
+    }
     if (_onLoadingFinish) {
       NSMutableDictionary<NSString *, id> *event = [self baseEvent];
       [event addEntriesFromDictionary: @{@"navigationType": message.body}];
       _onLoadingFinish(event);
     }
   } else if ([message.name isEqualToString:MessageHandlerName]) {
+    // Orca: only the page's own document may message the app. A subframe (for example agent HTML in
+    // a sandboxed iframe) reaches this handler too, and a non-string body is not a message.
+    if (!message.frameInfo.isMainFrame || ![message.body isKindOfClass:[NSString class]]) {
+      return;
+    }
     if (_onMessage) {
       NSMutableDictionary<NSString *, id> *event = [self baseEvent];
       [event addEntriesFromDictionary: @{@"data": message.body}];
diff --git a/index.d.ts b/index.d.ts
index 10b9c145b920a6a2ba1fb09bd72150328fafe211..626a67a3d6aca587ee9e74a52b799a2c50b4c52b 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -5,7 +5,7 @@ export { FileDownload, WebViewMessageEvent, WebViewNavigation } from './lib/WebV
 
 export type WebViewProps = IOSWebViewProps & AndroidWebViewProps & WindowsWebViewProps;
 
-declare class WebView<P = undefined> extends Component<WebViewProps & P> {
+declare class WebView<P = {}> extends Component<WebViewProps & P> {
   /**
    * Go back one page in the webview's history.
    */