concept · privacy & security

Focus Hijack Guard

Two embedded frames run the same focus tests. The right frame carries allow="focus-without-user-activation 'none'". Watch the parent focus indicator and per-frame logs update as scripted focus paths are allowed or blocked.

Policy introspection Waiting for iframe reports...

Unrestricted iframe automatic focus allowed

waiting for unrestricted frame...

Policy-restricted iframe automatic focus denied

waiting for restricted frame...

run the same scripted attempt in both frames

These parent-triggered commands are not user activation inside either iframe, so they model the focus-hijack paths the policy is designed to suppress.

event log

Waiting for iframe activity...

Both iframes expose a click-to-focus field so you can verify the important non-regression: user-initiated focus still works. The policy only suppresses automated focus without activation.

the markup

<iframe src="embed.html"></iframe>

<iframe src="embed.html"
        allow="focus-without-user-activation 'none'">
</iframe>

Permissions-Policy: focus-without-user-activation=()

what this page exercises

element.focus() without user activation
window.focus() without user activation
new controls with the autofocus attribute inserted by script
dialog.showModal() with a focusable dialog control
showPopover() with an autofocus control inside the popover
direct user click/tap focus inside both frames

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗