The current Async Cookies API implementation incorrectly allows an active service worker version to call cookieStore.subscribeToChanges(), if another version is installing at the same time. This should be fixed by having the CookieStoreManager methods (in content/browser/cookie_store) take in service worker version IDs.

Currently, we have no easy way to get the service worker's version ID in the renderer. The right long-term approach is to have the mojo interfaces "know" what service worker they're talking to. So, the mojo APIs shouldn't pass SW registration or version IDs. In particular, the renderer should remain ignorant about version IDs. Instead, the browser-side API context / host objects should keep track of service worker identities and pass registration / version IDs into the implementations.

The most likely paths forward entail plumbing version IDs through content/browser/renderer_interface_binders.cc or ServiceWorkerProviderHost.