diff --git a/content/browser/service_worker/service_worker_main_resource_handle.cc b/content/browser/service_worker/service_worker_main_resource_handle.cc index 4cd3f0044247e..5942495d9aafc 100644 --- a/content/browser/service_worker/service_worker_main_resource_handle.cc +++ b/content/browser/service_worker/service_worker_main_resource_handle.cc @@ -109,6 +109,15 @@ bool ServiceWorkerMainResourceHandle::InitializeForRequest( client_for_prefetch->key() != key) { return false; } + // The prefetch's ServiceWorkerClient must belong to the same + // ServiceWorkerContext (and hence the same StoragePartition) as this + // navigation handle. The prefetch client is always created from the + // default StoragePartition (PrefetchStreamingURLLoader), while + // `context_wrapper_` reflects the navigation's actual partition (e.g. a + // /Controlled Frame guest partition). + if (client_for_prefetch->context().get() != context_wrapper_->context()) { + return false; + } } isolation_info_ = std::move(new_isolation_info);