The Resurrection Exploit: How Service Workers Spawn Immortal Trackers

Clearing your cookies has always carried a certain reassurance. You open your settings, select "Clear cookies and site data," and the counter resets. Whatever was following you is gone. That, at least, is the assumption. In practice, one category of tracking is built specifically to survive that action — and it does so within milliseconds of your return to the site. Understanding why requires looking at a browser feature most people have never heard of, and at how the advertising industry repurposed it.

Why cookie clearing feels like a fix — and where it stops working

Deleting cookies removes files from one specific location: the browser's standard cookie storage. For most conventional tracking, that is enough. A third-party cookie dropped by an ad network lives there, and wiping it genuinely removes it.

The limitation is that a browser stores data in more than one place. Modern browsers maintain several independent storage systems, each governed by its own rules and each untouched by the "clear cookies" command. A tracking identifier saved in one of those other systems remains intact after your cleanup. Worse, it can be used to rebuild the very cookie you just deleted.

This is the mechanism behind what security researchers call a "Zombie Cookie" — a tracking token that reappears after removal. The technology that makes the resurrection possible is the Service Worker.

What a Service Worker is, and why browsers trust it

Service Workers were not designed for tracking. They exist to make websites behave more like installed applications. A Service Worker is a JavaScript file that runs in the background, separate from any page you have open. It handles push notifications, background data syncing, and offline loading — the reason some web apps continue to work when your connection drops.

That offline capability creates a technical requirement. A Service Worker has to function without a live network connection, which means it needs somewhere to keep data locally. Browsers provide this through persistent storage systems that sit apart from the cookie jar, most notably the Cache Storage API and IndexedDB.

Two properties of these systems matter here. They are persistent by design, intended to survive across sessions so offline features keep working. And they are structurally separate from standard cookie storage, so clearing cookies does not clear them.

For a legitimate web app, this separation is useful. For a tracking network, it is a storage location that ordinary privacy hygiene overlooks.

How a tracker plants the backup copy

When you load a page carrying this type of surveillance, the network does more than set a normal cookie. In the background, it registers a Service Worker without any visible indication. That worker takes your assigned tracking identifier and writes a duplicate copy into its own isolated Cache Storage.

At this point you have two copies of the same identifier: one in the standard cookie jar, one hidden in the Service Worker's private storage. You can see and delete the first. The second sits outside the reach of the "clear cookies" control, waiting.

“

You did everything correctly, and the identifier that ties your activity together returned on its own.

The resurrection, step by step

The value of the backup copy becomes clear the moment you try to reset your privacy. Here is the sequence.

Why these trackers are hard to see and harder to remove

Several characteristics make Service Worker tracking difficult to counter with standard habits.

It runs when the page is closed. Because a Service Worker operates independently of any open tab, it can continue its syncing and restoration work after you have navigated away or shut the tab entirely.

Legacy blockers miss it. Older privacy extensions work by inspecting network requests a page sends outward. A Service Worker changes the path. It acts as a proxy inside your own device, so the page requests data from the local worker rather than from a remote server. There is no outbound network request at that moment for a traditional blocker to catch.

Removal is buried. Manually clearing a Service Worker means navigating hidden browser pages such as chrome://serviceworker-internals/. Most people have no reason to know these scripts exist, let alone that one is quietly reinstating a tracking token each time the browser opens.

Taken together, these factors mean the usual response — clear, repeat, hope — turns into an endless loop against a script engineered to outlast it.

Where the cycle can actually be broken

The pattern across this series holds here as well. The tracking depends on one precondition: the malicious Service Worker has to be registered on your device in the first place. Registration happens through a specific instruction, navigator.serviceWorker.register(), sent by the tracking script when the page loads. No registration means no hidden worker, no backup copy, and nothing to restore a deleted cookie from.

That precondition is the point of intervention. Rather than fighting the resurrection after it happens, the effective approach is to stop the worker from being installed at all.

This is the layer Total Adblock operates on. Using declarative network filtering, it examines a page's structure as it loads and identifies the third-party domains, telemetry endpoints, and AdTech scripts that attempt to register a Service Worker for tracking purposes. It blocks that registration request before it executes. If the worker is never installed, no duplicate identifier is cached, and a cleared cookie has nothing to bring it back.

The logic follows a clean chain. No registration script runs, so no tracking Service Worker is created. No Service Worker means no isolated cache holding a spare copy of your ID. No spare copy means that when you delete a cookie, it stays deleted.

It is worth stating the limit plainly, as in the earlier articles. Blocking registration prevents new tracking workers from taking hold; it does not reach into and rewrite whatever a site may have stored during a past visit. Its function is to close the door going forward — which, against a mechanism designed to persist, is the door that matters. And because the filtering targets tracking endpoints rather than legitimate scripts, the genuine offline features of the web apps you rely on continue to work.

Make deletion mean deletion again

The unsettling part of Zombie Cookies is not sophistication but persistence. A tool built for offline convenience was turned into a way to make your privacy choices reversible without your knowledge. Clearing cookies still does exactly what it always did — it just stopped being the whole picture, because the copy that mattered was kept somewhere the command never touched.

The fix is not to abandon web apps or to memorize hidden browser menus. It is to prevent the tracking worker from installing in the first place, so there is no backup copy to resurrect anything from. Block the registration at the source, and clearing your cookies goes back to meaning what you always thought it meant.

Let Total Adblock stop these workers before they take hold, so that when you delete something, it stays deleted.