v146 · Security · Permissions

Selective permissions intervention

Chrome 146 introduces a permissions intervention that blocks permission prompts from sites that repeatedly show prompts after the user has denied them. Sites that persist in requesting the same permission after denial are silenced — their permission requests are auto-denied without showing a prompt.

concepts

  1. Intervention Demo

    Shows how the Permissions API behaves before and after the intervention kicks in. Includes a test to check your site's permission prompt status and read the PermissionStatus state.

  2. Affected APIs

    Which permission types the intervention covers, how Chrome tracks abuse signals, and what sites should do differently to avoid being silenced.

  3. Intervention policy graph

    Tune the abuse, user-history and engagement signals and watch a live bar chart recompute the granted / prompt / blocked verdict per API.

  4. Permission Health Checker

    A live probe table for 9 permissions (camera, mic, geolocation, notifications, clipboard-read/write, persistent-storage, midi, push). "Check all" queries navigator.permissions.query() with feature detection fallback. Each row shows a selective intervention badge (applies / not subject), a revocation risk score (low/medium/high), and per-permission remediation tips with recommended code patterns.

why it shipped

Permission prompt spam — repeatedly asking for camera, microphone, notifications, or location access after the user has denied — is a common dark pattern. It erodes user trust and creates permission fatigue. Chrome 146's selective intervention uses abuse signals (denial rate, prompt frequency, time since last denial) to identify sites that are repeatedly prompting users who have said no, and automatically silences future prompts from those sites. Well-behaved sites that respect denials are unaffected.

the change

// Permission request — unchanged API
const result = await navigator.permissions.query({ name: 'notifications' });

// After the intervention kicks in on abusive sites:
// result.state === 'denied'  ← without showing a prompt
// The site never knows it was silenced vs. the user actively denying

// Best practice: check permission status before prompting
const status = await navigator.permissions.query({ name: 'camera' });
if (status.state === 'denied') {
  // Don't prompt — explain why camera is needed and how to re-enable
  showPermissionExplanation();
  return;
}
if (status.state === 'granted') {
  startCamera();
  return;
}
// Only prompt when state === 'prompt'
const stream = await navigator.mediaDevices.getUserMedia({ video: true });

references