demo · v136

PP iframe reports

Define a parent-page Permissions-Policy AND an iframe allow attribute. If they conflict, Chrome 136 fires a Potential Permissions Policy violation report — observable by the parent.

Probing…

captured PermissionsPolicyViolationReport entries

none yet

the code

// On the parent page:
//   Permissions-Policy: camera=()
// In the iframe HTML:
//   <iframe allow="camera *" src=...>
// → conflict! parent forbids camera, but iframe's allow asks for it.

new ReportingObserver((reports) => {
  for (const r of reports) {
    if (r.type === "permissions-policy-violation"
        && r.body.disposition === "report") {
      console.log(r.body); // featureId, sourceFile, lineNumber...
    }
  }
}, { types: ["permissions-policy-violation"] }).observe();

see also