Skip to content

Malicious Service Workers or Progressive Web Applications (PWA)

Progressive Web Applications, also known as "PWAs" are designed to offer a native app-like experience via the web. They utilize features such as Service Workers to enable functionalities like offline usage, background syncing, and push notifications. However, the power and versatility of Service Workers can also pose security risks if misused by malicious actors.

How Malicious PWAs Operate

While the Chrome Web Store enforces security protocols for listed apps and extensions, PWAs can be installed directly from the web. This allows malicious PWAs to bypass the rigorous review process that is often present on Chrome Extensions and Android Applications. Once installed, a compromised PWA can exploit Service Workers to persist harmful scripts on your device, steal data, or inject malicious content into web sessions.

Google has implemented several security mechanisms, such as Content Security Policy (CSP) and isolation models, to mitigate these risks. Despite these efforts, some malicious PWAs may still operate undetected if users are not cautious.

Identifying and Handling Malicious PWAs

ChromeOS provides robust tools for identifying and managing potentially harmful PWAs. Here's how to check if you have a suspicious PWA installed:

  1. Access Installed Apps:
    Open the ChromeOS Launcher and navigate to your installed applications. Look for PWAs you don't recognize or those you suspect of malicious activity.

  2. Remove Suspicious PWAs:
    To uninstall a PWA:

  3. Right-click the app icon.

  4. Select "Uninstall" or "Remove from Chrome."

  5. Inspect Service Workers:
    Service Workers can be examined for unusual activity:

    chrome://serviceworker-internals
  6. Review registered Service Workers and their origins. Remove or unregister any that seem suspicious by selecting the "Unregister" button.