v149 · Origin Trial · Permissions Policy

Policy Test Lab

Two live iframe containers — one unrestricted, one with allow="focus-without-user-activation 'none'". Each iframe receives the same parent commands and reports whether its own element.focus() call succeeded.

How to set the policy on an iframe:
<iframe src="…" allow="focus-without-user-activation 'none'"></iframe>
Or via HTTP header (for all frames):
Permissions-Policy: focus-without-user-activation=()
Unrestricted iframe (no policy) can steal focus

This iframe has no policy restriction. Parent-triggered and timer-triggered focus attempts can move focus inside the frame.

waiting for iframe
Restricted iframe (policy applied) focus blocked

This iframe carries allow="focus-without-user-activation 'none'". Parent-triggered focus is blocked; a direct click inside the frame remains allowed.

waiting for iframe

event log

— interact with the live iframes above —

the policy in code

/* HTML: deny focus-stealing for embedded frame */
<iframe src="https://ad-network.example/ad"
        allow="focus-without-user-activation 'none'">
</iframe>

/* HTTP: apply globally to all frames in this document */
Permissions-Policy: focus-without-user-activation=()

/* Inside the iframe, this is silently dropped: */
setTimeout(() => input.focus(), 2000); // ← blocked (no user activation)
input.autofocus = true;                // ← blocked on load

/* User-initiated focus still works: */
button.addEventListener('click', () => input.focus()); // ← allowed */

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗