diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
index b2b4a60cd..7022bc779 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
@@ -124,7 +124,14 @@ export default {
 
     handleSignupMessage(event) {
       // Handle Facebook embedded signup message events
-      if (!event.origin.endsWith('facebook.com')) return;
+      try {
+        const originUrl = new URL(event.origin);
+        const allowedHosts = ['facebook.com', 'www.facebook.com'];
+        if (!allowedHosts.includes(originUrl.hostname)) return;
+      } catch (error) {
+        // Invalid origin URL, reject the event
+        return;
+      }
 
       try {
         const data = JSON.parse(event.data);