Does a blob URL iframe work?

Yes. Blob URL iframe -> service worker iFrame & srcset iframe -> service worker iFrame works as expected; it is only data: URL case

Thanks for the issue...

Tried to reproduce the issue on latest chrome stable 70.0.3538.77 using Windows 10. Attaching screen-cast for reference.
Steps: 
------
1. Launched reported chrome 
2. Downloaded given given all attached file and kept in one folder 
3. Opened the html file and >> Opened Dev tools >> Applications >> service Workers 
4. With checked and unchecked the bypass >> observed the behavior as per attached screencast
As we have observed the responses from server 

@Reporter: Could you please check the attached screen cast and please let us know if anything missed from our end also upgrade to latest chrome : https://www.chromium.org/getting-involved/dev-channel ". Let us know whether issue still persists.

Thanks.!

Deleted: 899334.mp4 4.7 MB

	899334.mp4 4.7 MB View Download

My bad - added a bit of code in SW-generated page that was acting weird. I've changed a SW code a bit, to make it work. Updated sw.js to make a good demo.

Checked on 
- 70.0.3538.77 (Official Build) (64-bit)
- 72.0.3595.2, dev (64 bit) 
- 72.0.3598.0 (Official Build) canary (32-bit)

I've recorded a video of what's happening on Chrome dev.

and got same behavior everywhere

Deleted: sw.js 635 bytes

sw.js 635 bytes View Download

Deleted: Annotation (1).png 164 KB

	Annotation (1).png 164 KB View Download

Deleted: index.html 104 bytes

index.html 104 bytes View Download

Deleted: about_blank - Google Chrome 2018-11-01 17-43-53.mp4 464 KB

	about_blank - Google Chrome 2018-11-01 17-43-53.mp4 464 KB View Download

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

There was a change at some point to make data URL frame get an opaque origin instead of inheriting from the parent.  I wonder if chrome is further restricting nested third parties as well for some reason.

Thanks for the explanation.
From my point of view it's more bug rather than feature, as long as

- behavior is inconsistent with other clientside-generated frames (blob & srcdoc)
- behavior is inconsistent with all other browsers (FF, Edge, did not check Safari)
- theoretically it can become a security/stability issue (if someone will decide that building a cross-domain API over service worker iframes is a good idea)

Action items:
- Determine whether this is the expected behavior.
- Add WPT tests for this if there are none.