v141 · device

Permissions policy for Device Attributes API

The new Permissions Policy enables restricting access to the Device Attributes API, which is available only for policy-installed kiosk web apps and policy-installed Isolated Web Apps, both only on managed ChromeOS devices.

concepts

  1. Device Attributes Policy

    Adds Permissions Policy gating for the Device Attributes API. Important for kiosk/IWA contexts where embedded third parties shouldn't see device identity.

  2. iframe Isolation

    Pick a top-level Permissions-Policy value and watch four embedded frames (first-party signage, trusted vendor, ad banner) get allowed or blocked from navigator.managed.

  3. Enterprise Rollout

    The three Google-admin policies (DeviceAttributesAllowedForOrigins, BlockedForOrigins, DefaultSetting) form a precedence chain. Edit the lists, type an origin, see the decision.

  4. Policy Configurator

    Build a Permissions-Policy: device-attributes=() header interactively — add allowed origins, toggle self/none/star, and see the effect on four simulated embedded frames (first-party kiosk, trusted vendor widget, ad banner, cross-origin analytics) each probing navigator.managed.

why it shipped

The Device Attributes API allows web developers to query information about the device. This information can be used for context-based configuration or other device-aware use cases such as licensing.

references