WorkerGlobalScope.isSecureContext should be based on owner's top-level creation URL, not the owner's URL: - https://html.spec.whatwg.org/multipage/webappapis.html#secure-context This means that if a worker created in a HTTPS iframe, under a HTTP top-level document should not be considered as secure. This is causing us to fail the "HTTPS worker from HTTPS subframe" subtest on secure-contexts/basic-dedicated-worker.html WPT test. This test is passing in both Gecko and Blink.