FWIW I've used the location with a private channel as protocol to intercept calls to/from the page and GJS.
From the page, which is aware of the "secret" channel, I call GJS actions via location.href = "">
The protocol secret1234 is intercepted and the `controller.method(JSON.parse(decodeURIComponent(restOfURI)))` invoked.
The page has a listener for the `secret1234` event on the main window, and such listener is instrumented to react accordingly with the CustomEvent .detail payload/info.
This might look a bit convoluted, and it has JSON serialization as limitation for the kind of data you want to pass (i.e. I use base64 encoded images as source from remotely fetched files enabling somehow CORS for whatever I want) but it worked well, circumventing the missing communication channel available in Qt.
Maybe today there are better ways for doing a similar thing and if that's the case, please share.