A SharedWorker is a browser worker that multiple same-origin tabs or frames can connect to and use as one shared background process. It is meant for legitimate coordination, such as sharing state, handling messages, or avoiding duplicated work across pages from the same site. Because it runs outside the visible page, it can keep logic alive even when several tabs are open.
In security terms, that background role matters. Attackers can abuse a SharedWorker to coordinate malicious logic across browser contexts, route messages, or assemble behavior at runtime instead of dropping a single obvious file. That can make hash-based and file-based detection less effective. Defenders should watch for unusual worker registration, unexpected message traffic, and suspicious same-origin fetch or coordination patterns. In a normal app, a SharedWorker supports efficiency; in an attack, it can become a covert control point inside the browser.