earner-recording-settings.uber.com listens for postMessage with type "onDialogAction" but never checks the origin. Any page can open it and toggle a driver's recording settings.