---
id: 5456
title: "Hijacking service workers via DOM Clobbering"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering"
published_at: "2022-12-05T08:50:00Z"
tags: ["web-security", "xss", "client-side-security", "csp-bypass", "dom-clobbering", "service-worker"]
phying_url: "https://phying.com/item/5456"
lang: en
---

# Hijacking service workers via DOM Clobbering

## Summary

A new service worker hijacking variant using DOM clobbering: abusing a document.getElementById() quirk to control importScripts() and run script inside the SW, enabling filter evasion and CSP bypass.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-12-05T08:50:00Z
- **Original:** https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering
- **Phying News:** https://phying.com/item/5456