v146 · Security · Affected APIs
Affected APIs
Which permission types Chrome 146's intervention covers, the abuse signals it tracks, and what developers should do differently.
The intervention is selective — it only activates for sites that have established a pattern of repeated prompting after denial. Well-behaved sites that check permission status before prompting and respect denials are not affected.
affected permissions
| Permission | API | Intervention applies |
|---|---|---|
| Notifications | Notification.requestPermission() |
Yes |
| Camera | getUserMedia({ video: true }) |
Yes |
| Microphone | getUserMedia({ audio: true }) |
Yes |
| Geolocation | getCurrentPosition() / watchPosition() |
Yes |
| Clipboard read | navigator.clipboard.read() |
Yes |
| Storage (cookies, localStorage) | N/A — not gated by permission prompts | No |
| WebAuthn / credentials | Platform authenticators — user activation required | No |
abuse signals Chrome tracks
- High denial rate — a high proportion of users who see this site's prompt deny it
- Prompt frequency — site shows permission prompts very frequently relative to page visits
- Re-prompt after denial — site requests the same permission again within a short window after the user denied
- Dismiss without answer — high rate of users dismissing (closing) the prompt rather than granting or denying
developer guidance
// ✓ Check status before prompting
const status = await navigator.permissions.query({ name: 'geolocation' });
if (status.state !== 'prompt') return; // Don't prompt if denied or granted
// ✓ Gate behind explicit user action
locationBtn.addEventListener('click', async () => {
navigator.geolocation.getCurrentPosition(success, error);
});
// ✓ After denial, guide to settings — don't re-prompt
function handleDenied() {
showMessage('Location access is blocked. ' +
'Click the lock icon in the address bar → Site settings → Location → Allow.');
}
// ✗ Never do this:
// Request on page load — no user context
window.addEventListener('load', () => Notification.requestPermission());
// ✗ Never do this:
// Re-prompt immediately after denial in the same session
status.addEventListener('change', () => {
if (status.state === 'denied') {
Notification.requestPermission(); // BAD — triggers intervention
}
});