diff --git a/.changeset/neat-donuts-teach.md b/.changeset/neat-donuts-teach.md
new file mode 100644
index 0000000000..adb7654780
--- /dev/null
+++ b/.changeset/neat-donuts-teach.md
@@ -0,0 +1,5 @@
+---
+'@gitbook/react-contentkit': patch
+---
+
+Fix potential invalid URL error in react-contentkit
diff --git a/packages/gitbook/src/components/Insights/cookies.ts b/packages/gitbook/src/components/Insights/cookies.ts
index 0dfa021b98..a25e196ba3 100644
--- a/packages/gitbook/src/components/Insights/cookies.ts
+++ b/packages/gitbook/src/components/Insights/cookies.ts
@@ -20,13 +20,21 @@ export function setCookiesTracking(enabled: boolean) {
  * Return `undefined` if state is not known.
  */
 export function isCookiesTrackingDisabled() {
-    const state = cookies.get(GRANTED_COOKIE);
+    try {
+        const state = cookies.get(GRANTED_COOKIE);
 
-    if (state === 'yes') {
-        return false;
-    } else if (state === 'no') {
-        return true;
-    }
+        if (state === 'yes') {
+            return false;
+        } else if (state === 'no') {
+            return true;
+        }
 
-    return undefined;
+        return undefined;
+    } catch (error) {
+        // If there is a security error, we consider cookies as disabled
+        if (error instanceof Error && error.name === 'SecurityError') {
+            return true;
+        }
+        throw error;
+    }
 }
diff --git a/packages/gitbook/src/lib/local-storage.ts b/packages/gitbook/src/lib/local-storage.ts
index f96653dff5..fb0833d604 100644
--- a/packages/gitbook/src/lib/local-storage.ts
+++ b/packages/gitbook/src/lib/local-storage.ts
@@ -2,11 +2,10 @@
  * Get an item from local storage safely.
  */
 export function getItem<T>(key: string, defaultValue: T): T {
-    if (typeof localStorage === 'undefined') {
-        return defaultValue;
-    }
-
     try {
+        if (typeof localStorage === 'undefined') {
+            return defaultValue;
+        }
         const stored = localStorage.getItem(key);
         return stored ? (JSON.parse(stored) as T) : defaultValue;
     } catch (error) {
@@ -21,11 +20,10 @@ export function getItem<T>(key: string, defaultValue: T): T {
  * Set an item in local storage safely.
  */
 export function setItem(key: string, value: unknown) {
-    if (typeof localStorage === 'undefined') {
-        return;
-    }
-
     try {
+        if (typeof localStorage === 'undefined') {
+            return;
+        }
         localStorage.setItem(key, JSON.stringify(value));
     } catch (error) {
         if (error instanceof Error && error.name === 'SecurityError') {
diff --git a/packages/react-contentkit/src/ElementWebframe.tsx b/packages/react-contentkit/src/ElementWebframe.tsx
index 866c8e8f57..3d256b5b82 100644
--- a/packages/react-contentkit/src/ElementWebframe.tsx
+++ b/packages/react-contentkit/src/ElementWebframe.tsx
@@ -58,6 +58,11 @@ export function ElementWebframe(props: ContentKitClientElementProps<ContentKitWe
             }
 
             const message = event.data;
+
+            if (!URL.canParse(event.origin)) {
+                return;
+            }
+
             const origin = new URL(event.origin);
 
             // For security reasons, only iframe from our integrations domains are allowed