Blocked a frame with origin “https://XXX-dev-ed.lightning.force.com” from accessing a cross-origin frame

For my taste you got a lot of misleading answers here... This behavior has nothing to do with LockerService. Without LockerService it is exactly the same as you have already observed. The sole reason is the fact that visualforce pages are served from a different domain than Lightning Experience (holding your Lightning Component). This is done by Salesforce on purpose and it's considered as a security feature. You can't turn it off. Good news: there is an officially documented practice to overcome this frontier by using window.postMessage(). With that you can implement bidirectional communication between Visualforce and Lightning Components.

           https://developer.salesforce.com/blogs/developer-relations/2017/01/lightning-visualforce-communication.html

There is no need of making REST calls for communication between VF and Lightning or going back to the server as crmprd dev describes. window.postMessage() is also not affected by  http://documentation.auraframework.org/lockerApiTest/index.app?aura.mode=DEV That means all this works fine with v40.0 and chances are very good that it will work in future versions either.