Andrew Sutherland

The issue occurs when a HTTPS page is embedded in a HTTP page and a service worker is registered for the secure page. In such cases, the service worker could intercept the request for the secure page, despite the iframe not being a secure context due to the insecure framing.

The issue is related to a use-after-free vulnerability in the HTMLVideoElement interface, which can be exploited by remote attackers to execute arbitrary code via crafted JavaScript code. This code modifies the URI table of a media element.

The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors.