v151 · Web APIs · Permissions Policy

Typing Interrupt

A real iframe fires element.focus() every few seconds — the classic focus-stealing pattern that disrupts users typing in forms. Toggle focus-without-user-activation to allow or deny and watch whether the iframe can steal focus from your typing field.

Checking Permissions Policy support…
Permissions-Policy: focus-without-user-activation=
user's page typing here
Type here — try to keep focus:
embedded widget iframe focus-without-user-activation: allow
This iframe calls focus() on its own input without user activation every 3 seconds, matching the focus-stealing pattern used by disruptive embeds.
focus() attempts: 0
focus stolen: 0
focus blocked: 0
next focus() attempt
event log

what the policy controls

code

<!-- Parent page header -->
<!-- Permissions-Policy: focus-without-user-activation=() -->
<!-- Or per-iframe via allow attribute: -->

<!-- Deny focus-stealing for an ad embed -->
<iframe src="https://ad.example/"
        allow="focus-without-user-activation 'none'"></iframe>

<!-- Allow for a trusted first-party embed (default behaviour) -->
<iframe src="https://app.example/"
        allow="focus-without-user-activation"></iframe>

<!-- Inside the iframe -->
// Blocked when policy denies it (no user activation):
setTimeout(() => inputEl.focus(), 3000);

// Always works (user activation present):
button.addEventListener('click', () => inputEl.focus());

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗