Defenses: The page allows registering a Service Worker, but you control the script URL via the sw parameter. However, cross-origin Service Workers are blocked by the browser.
We are testing a new offline mode using Service Workers. You can provide a custom Service Worker script via the ?sw= parameter.
CONCEPT: Service Worker Hijacking via JSONP
Service Workers are highly privileged scripts that can intercept all network requests made by the browser. To prevent abuse, browsers strictly enforce that a Service Worker script must be hosted on the same origin as the page registering it. An attacker cannot register a Service Worker pointing to https://attacker.com/malicious.js. However, if the target application hosts an open redirect or a vulnerable JSONP endpoint (an API that wraps JSON data in a user-provided JavaScript callback function), the attacker can point the Service Worker registration to that endpoint. Because the endpoint is on the same origin and returns attacker-controlled JavaScript, the browser successfully registers the malicious script, giving the attacker a persistent backdoor.
No Service Worker URL provided.