Hijacking service workers via DOM Clobbering
Summary: PortSwigger researcher Gareth Heyes described a variant of service worker hijacking triggered through DOM clobbering, exploiting a quirk in document.getElementById() where injecting an <html> or <body> tag with a matching id can override the element the page reads. Because service workers lack access to the parent page's DOM, sites pass them data through query parameters, and insecure handling of those parameters can let an attacker control the host used by importScripts() and thereby control the site's responses.
Why it matters: The post notes this vulnerability is rare but has a much higher impact than typical XSS, enabling permanent client-side site takeover, and the researchers found a major website passing a CDN domain to its service worker via the innerText of a <div> with id "cdnDomain".
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026