demo · v151

Focus-Steal Attack Replay

Three classic focus-steal scenarios that the new policy was designed to defeat — a credential overlay, a polled-poll embed, and an ad iframe yanking focus mid-typing. Replay each, then enable the policy and confirm the attack falls flat.

For research / education. Each scenario below uses a real iframe. Toggling the policy reloads those frames with either allow="focus-without-user-activation" or allow="focus-without-user-activation 'none'", and the frames report actual focus results back to this page.

controls

attempts
0
stolen
0
blocked
0

scenario 1 — credential overlay

setup

You're typing your bank password. A "promo" embed loads and tries to focus its own password field every 4 seconds, intercepting any keystrokes you'd otherwise direct at the legitimate field.

[embed.example] enter promo code:

scenario 2 — polled poll

setup

An ad polls every 2.5 seconds and re-focuses its CTA button. While reading your own form, the cursor and ⌘+F search jump there.

[ads.example] CTA target →

scenario 3 — sandwich attack

setup

Two embeds compete for focus every 1.5 seconds. Without the policy, your draft is unwritable. With the policy, the embeds give up and your textarea wins.

[embedA] poll target →
[embedB] another poll target →

event log

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗