UTM params must be present in the iframe URL itself (e.g. src=".../iframe-utm-debug.html?utm_source=foo"). They are not automatically inherited from the parent URL.
document.referrer shows the embedding page’s URL (if not blocked by the browser/site).
The “postMessage” button sends the parsed params to the parent window under the event type iframe-utm-debug.