SkyZeroZx · Aug 25, 2025
diff --git a/packages/service-worker/worker/src/driver.ts b/packages/service-worker/worker/src/driver.ts
@@ -218,6 +218,11 @@ export class Driver implements Debuggable, UpdateSource {
     );
     this.scope.addEventListener('messageerror', (event) => this.onMessageError(event));
     this.scope.addEventListener('unhandledrejection', (event) => this.onUnhandledRejection(event));
+    this.scope.addEventListener('securitypolicyviolation', (event) =>
+      // It seems that typescript has not registered the event as indicated in the documentation.
+      // Issue: https://github.com/microsoft/TypeScript-DOM-lib-generator/issues/2123
+      this.onSecurityPolicyViolation(event as SecurityPolicyViolationEvent),
+    );
 
     // The debugger generates debug pages in response to debugging requests.
     this.debugger = new DebugHandler(this, this.adapter);
@@ -373,6 +378,15 @@ export class Driver implements Debuggable, UpdateSource {
     );
   }
 
+  private onSecurityPolicyViolation(event: SecurityPolicyViolationEvent): void {
+    // Handle security policy violations in the service worker.
+    // This is for debugging and preventing silent failures.
+    this.debugger.log(
+      `Security Policy Violation`,
+      `Driver.onSecurityPolicyViolation(reason: ${JSON.stringify(event)})`,
+    );
+  }
+
   private async ensureInitialized(event: ExtendableEvent): Promise<void> {
     // Since the SW may have just been started, it may or may not have been initialized already.
     // `this.initialized` will be `null` if initialization has not yet been attempted, or will be a

diff --git a/packages/service-worker/worker/test/happy_spec.ts b/packages/service-worker/worker/test/happy_spec.ts
@@ -1223,6 +1223,27 @@ import {envIsSupported} from '../testing/utils';
       });
     });
 
+    describe('securitypolicyviolation events', () => {
+      it('broadcasts security policy violation events', async () => {
+        await driver.initialized;
+        const debuggerLogSpy = spyOn(driver.debugger, 'log');
+
+        const event = {
+          violatedDirective: 'script-src',
+          blockedURI: 'http://example.com',
+          originalPolicy: "default-src 'self'",
+          statusCode: 500,
+        } as SecurityPolicyViolationEvent;
+
+        scope.handleSecurityPolicyViolation(event);
+
+        expect(debuggerLogSpy).toHaveBeenCalledWith(
+          'Security Policy Violation',
+          jasmine.stringMatching(/^Driver\.onSecurityPolicyViolation\(reason: .*?\)$/),
+        );
+      });
+    });
+
     describe('notification close events', () => {
       it('broadcasts notification close events', async () => {
         expect(await makeRequest(scope, '/foo.txt')).toEqual('this is foo');

diff --git a/packages/service-worker/worker/testing/scope.ts b/packages/service-worker/worker/testing/scope.ts
@@ -292,6 +292,14 @@ export class SwTestHarnessImpl
     this.eventHandlers.get('unhandledrejection')!.call(this, event);
   }
 
+  handleSecurityPolicyViolation(event: SecurityPolicyViolationEvent): void {
+    if (!this.eventHandlers.has('securitypolicyviolation')) {
+      throw new Error('No securitypolicyviolation handler registered');
+    }
+
+    this.eventHandlers.get('securitypolicyviolation')!.call(this, event);
+  }
+
   override timeout(ms: number): Promise<void> {
     const promise = new Promise<void>((resolve) => {
       this.timers.push({