Collected research

Service Workers: New APIs = New Vulns = Fun++

[Service Workers] New APIs = New Vulns = Fun++

sirdarckcat · sirdarckcat.blogspot.com

Shows how page JavaScript can poison service-worker caches, turning reflected XSS into persistent client-side execution. Caching redirected cross-origin responses under the original URL can also turn an open redirect into persistent XSS. Discusses response URL checks, templating, and offline CSRF handling.

Record

Document

[Service Workers] New APIs = New Vulns = Fun++

Researcher

sirdarckcat

Published by

sirdarckcat.blogspot.com

Topic

Other

In the archive

• Collected in the 2015 research round

Related sources

• Service Workers security Slides

Tags

• service-worker
• cache-poisoning
• xss
• open-redirect
• csrf
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of sirdarckcat, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.