The registered Service Worker script can hijack login credentials and modify the webmail page to add malicious scripts in case the attackers were unable to inject the XSS vulnerability mentioned above.