It looks like WebWorkers are not a security feature, but simply a way to run background threads on the client side of the web application. This means they don't protect you from any existing attacks but they may instead introduce new attack vectors :(
Of interest in this regard might be the communication between the workers and the main thread: they are reusing the postMessage interface which was originally used to communicate between different frames. By using the same interface it also adds the same security issues. This means you should check for the origin of a received message in your message event handler. The example code you will find for web workers usually does not do this.