Skip to content
Hijacking service workers via DOM Clobbering
portswigger.net | research | #web-security | #xss | #client-side-security | #csp-bypass | #dom-clobbering | #service-worker
Summary
A new service worker hijacking variant using DOM clobbering: abusing a document.getElementById() quirk to control importScripts() and run script inside the SW, enabling filter evasion and CSP bypass.
- Published
- Collected