demo · v136

Report listener

v136 surfaces permissions-policy violations from iframes through the Reporting API. Wire a ReportingObserver in the parent and watch real violations stream in as the iframe attempts disallowed features (camera, geolocation, payment).

ReportingObserver listens for type 'permissions-policy-violation'.

Iframe with allow="camera 'none'; geolocation 'none'" — the iframe inside intentionally tries forbidden APIs.

reports received0
last violation—

report stream

the code

const obs = new ReportingObserver((reports) => {
  for (const r of reports) {
    if (r.type === "permissions-policy-violation") {
      console.log(r.body);
      // { featureId, sourceFile, lineNumber, disposition, ... }
    }
  }
}, { types: ["permissions-policy-violation"], buffered: true });
obs.observe();

why this angle

The sibling concept catalogs which features can be policy-controlled. This concept wires the actual reporting endpoint — the v136 plumbing that finally makes iframe violations observable from the parent. Real-world this is what lets a host page audit whether its third-party embeds are quietly trying to call APIs they're not allowed to.

see also