Overview
- Google published technical details of a multi-layered ‘defense-in-depth’ toolkit for Chrome that combines permission UX changes, behavioral detection of coordinated site networks, automatic permission revocations and server-side delivery limits.
- Chrome automatically revokes notification permission for sites a user no longer engages with and for sites that repeatedly trigger suspicious-notification warnings, and users can review and regrant those permissions in Chrome’s Safety Hub or device settings.
- The Chrome team built behavioral signals that look for coordinated service-worker activity and related patterns to identify networks of sites sending deceptive or malicious notifications and proactively remove their access.
- On the delivery side, Firebase Cloud Messaging enforces message rate limits for disruptive domains, applying a baseline cap of 1,000 messages per minute and returning HTTP 429 errors when that threshold is exceeded.
- Google says the combined measures cut more than 7 billion unwanted Android notifications per day in early 2026 and also lowered unnecessary background activity and battery use while keeping legitimate publishers able to adjust and restore access.