A ServiceWorker is a browser script that runs in the background for a web app and can intercept network requests, cache responses, and handle offline or push-related tasks. It only operates within its registered origin and scope, which limits what it can control. Those limits make it safer than a full browser extension, but also powerful enough to influence how a site loads and what content reaches the page.
In cyber security, ServiceWorkers matter because attackers can abuse them as a stealthy control point inside the browser. If a victim is steered to a malicious or compromised web flow, a worker may help assemble code at runtime, rewrite requests, or stage payload logic without dropping a traditional executable. Defenders should watch for unusual worker registrations, unexpected fetch interception, and suspicious same-origin message traffic, since these are common signs of web-based abuse.