v136 · miscellaneous
Header Builder
Build Permissions-Policy and Permissions-Policy-Report-Only response headers plus the iframe allow attribute. The builder shows the generated headers, previews the violation report Chrome 136 would send for conflicting configurations, and lists which features would be blocked vs. report-only vs. allowed.
Chrome 136 introduces "Potential Permissions Policy violation" reports for iframes. When the parent's
Permissions-Policy header conflicts with the iframe's allow attribute, the browser now sends a report to the parent's Report-To endpoint. This demo generates the headers and predicts the violations you'd see.
Parent page policy (select allowlist per feature)
iframe allow attribute
Generated response headers
Click "Generate headers".
Predicted violations (Chrome 136)
| Feature | Parent policy | iframe allow | Outcome | Report sent? |
|---|---|---|---|---|
| Click "Generate headers" to analyze. | ||||
Example violation report body (Chrome 136)
{
"type": "permissions-policy-violation",
"age": 0,
"url": "https://iframe.example.com/widget",
"body": {
"featureId": "camera",
"message": "Potential Permissions Policy violation: camera is not allowed in this document.",
"disposition": "enforce",
"sourceFile": null,
"lineNumber": null,
"columnNumber": null
}
}