Anonymous
Regardless what desirable functionality they might potentially provide, I set them disabled.
For the sites I visit (YMMV), doing so across several years has caused ZERO noticable (to me) breakage.
BTW: the results of a websearch “serviceworker CVE” will be enlightening
Below is a peek at some of my tweaked browser prefs.
Your newer versioned browser may (probably does) have additional related prefs.
dom.serviceWorkers.enabled false
dom.webnotifications.serviceworker.enabled false (moot if serviceWorkers are diabled, but oh well)
dom.webnotifications.enabled false
dom.serviceWorkers.openWindow.enabled false (moot if serviceWorkers are diabled, but oh well)
dom.serviceWorkers.testUpdateOverOneDay false
dom.serviceWorkers.idle_timeout 1 (unit is milliseconds)
dom.serviceWorkers.idle_extended_timeout 1 (unit is milliseconds)
dom.push.enabled false
dom.push.connection.enabled false
dom.push.serverURL <specify an empty/blank string>
dom.push.userAgentID <specify an empty/blank string>
dom.push.udp.wakeupEnabled false
(who the Hell rationalized the enabling unsolicited browser comms via UDP would be a GoodIdea?!?)
=================
“workers” aka “dom workers” aka “web workers” are a different creature, separate from serviceworkers.
Less worrisome than serviceworkers (but rife for use by embedded coin miner scripts) I disable them also.
dom.workers.enabled false