Re: [ServiceWorker] WindowClient.navigate() for the same origin but off-scope clients (#752)

It seems `clients.matchAll({ includeUncontrolled: true })` combined with navigation of off-scope clients would allow a https://www.stanford.edu/~username/ tab to navigate another independent https://www.stanford.edu/ tab to a spoof URL, which isn't otherwise possible.

This seems like a general problem with off-scope WindowClients though, not one specific to navigate().

Perhaps you should only be able to access WindowClients that match the `maxScopeString` defined by the [Update algorithm](https://slightlyoff.github.io/ServiceWorker/spec/service_worker/#update-algorithm) (even if you pass `includeUncontrolled:true` to `matchAll`).

@jakearchibald 

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/752#issuecomment-149596013