On Chrome, at least, the following works to get the URL of the parent (at least the HTTPS and domain part of it):
anvil.js.window.document.location.ancestorOrigins[0]
It looks like Firefox doesn’t support it, though: "ancestorOrigins" | Can I use... Support tables for HTML5, CSS3, etc
Edit: also, this isn’t an Anvil issue, but an iframe issue. The normal way around it is for the enclosing page to pass information into the iframe, or for the two pages to send messages back and forth. That obviously won’t work for your case, since anything the enclosing page sends it can lie about.