v149 · Security · demo
Autofocus Policy Tester
The focus-without-user-activation permissions policy controls whether cross-origin iframes can steal focus via autofocus. Toggle the policy and observe how focus shifts — or stays — on the main page.
iframe allow policy:
Cross-origin iframe — contains
<input autofocus>
focus-without-user-activation: ALLOW
Focus Log — document.activeElement over time
—
Watching focus changes on this page…
Clickjacking replay — autofocus keyboard hijack
A malicious cross-origin iframe with autofocus can silently route keyboard input (including passwords) to itself, invisible to the user.
With focus-without-user-activation blocked, the autofocus is ignored — the main page retains focus until the user explicitly clicks into the iframe.
Policy Header Generator — server-side deployment
<!-- iframe: allow autofocus (risky) -->
<iframe allow="focus-without-user-activation" src="..."></iframe>
<!-- iframe: block autofocus (Chrome 149 default for cross-origin) -->
<iframe src="..."></iframe>
<!-- HTTP header: block for all embedded content -->
Permissions-Policy: focus-without-user-activation=()
<!-- HTTP header: allow same-origin only -->
Permissions-Policy: focus-without-user-activation=(self)see also
- Autofocus Lockdown — iframe lockdown patterns
- Focus Hijack Guard — detect hijack attempts
- Policy Test Lab — full policy matrix
- Back to feature index
- ChromeStatus entry
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗