v136 · miscellaneous

Permissions Policy reports for iframes

Introduces a new violation type called "Potential Permissions Policy violation", which will only look at Permissions Policy (including report-only policy) and the allow attribute set in iframes to detect the conflict between Permissions Policy enforced vs permissions propagated to iframes.

concepts

  1. Iframe PP Reports

    Permissions Policy violations from iframes flow into the parent's Reporting endpoint. Lets sites monitor third-party embed behaviour for unexpected feature requests.

  2. Report listener

    Wire a ReportingObserver in the parent and watch real permissions-policy-violation reports stream in as an iframe inside tries forbidden APIs.

  3. Policy Fuzzer

    Set an allow attribute, tick the features you want probed, and the child iframe walks the list while the parent's ReportingObserver streams every violation back. Regression-test embed allow-lists in seconds.

  4. Header Builder

    Configure per-feature parent policies and iframe allow values, pick enforce vs report-only mode, and get the exact Permissions-Policy header to deploy — plus a prediction of which features would trigger Chrome 136 violation reports and what those JSON bodies look like.

why it shipped

Permissions Policy violation reports for cross-origin iframes are only sent to the iframe's reporting endpoint and not to the embedder's reporting endpoint, because of the concern that it might leak sensitive information about a cross-origin iframe. However, this makes it difficult for sites to enforce Permissions Policy because it can't learn about breakages in cross-origin iframes.

references