A Survey on Vulnerabilities of Service Workers

In a Progressive Web App (PWA), a kind of application software of the web, a service worker (SW) plays a key role as a one of the fundamental components to enhance the user's browsing experiences. For this purpose, the SW supports several features such as push notification, offline access, background code execution, etc. Since the SW provides prolific capabilities, it has been the main target to abuse by malicious attackers to deliver diverse attacks through the web applications such as crypto-currency mining, history sniffing, phishing. In this paper, we introduce the SW's functionalities and vulnerabilities, and discuss the existing attack methodologies and their implications.