Thank you, Alex, for the LGTM!
Thomas, thanks for having a look. Those points you raise are
precisely what this permissions policy aims to address. I
tried to capture this in more detail in the explainer
webappsec-permissions-policy/policies/focus-without-user-activation.md
at ffiori/webappsec-permissions-policy
<https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md>.
Let me know if you have any questions.
Fernando
On Monday, October 19, 2026 at 4:19:14 PM UTC-7
[email protected] wrote:
not clear how this interfaces with w3c, but here are a
few threats I found partly from AI.
* *Keystroke Redirection & Phishing (Focus
Theft):*Embedded third-party content can silently
pull focus away from the main page input fields. If a
user is typing sensitive information (e.g.,
credentials, credit card numbers, or search queries),
their keystrokes can be redirected into an embedded
iframe or form without visual or immediate notice.
1 <https://chromestatus.com/feature/5179186249465856>
2
<https://mail.google.com/mail/u/0/#all/%23thread-f:1879048351712254581%7Cmsg-f:1879503045256153924>
* *Accessibility Disruption for Assistive
Technologies:*Screen readers and keyboard-only
navigation depend heavily on stable focus. Unprompted
focus changes forcibly relocate the reading or
keyboard focus, confusing visually or
mobility-impaired users and preventing them from
navigating predictably.
3
<https://www.webaccessibility.com/resource-library/best-practice/?bestPractice=801>
* *Keyboard Navigation Hijacking:*Users attempting to
navigate forms or pages via keyboard shortcuts or
|Tab|keys can be trapped or thrown off course if a
script continually pulls focus back to a specific
element.
3
<https://www.webaccessibility.com/resource-library/best-practice/?bestPractice=801>
* *UI Flickering & Performance Degradation:*When
multiple scripts or embedded frames aggressively run
scripts (e.g., using |element.focus()|,
|window.focus()|, or |blur|event polling) to reclaim
or maintain focus, it results in visible screen
flickering and erratic user interface behavior.
1 <https://chromestatus.com/feature/5179186249465856>
2
<https://mail.google.com/mail/u/0/#all/%23thread-f:1879048351712254581%7Cmsg-f:1879503045256153924>
* *Unwanted Modals & Dialog Interruptions:*Scripts can
force focus into programmatic popups or dialogs
(|dialog.showModal()|, popover focusing, or
|autofocus|), disrupting the workflow without any
preceding user action or gesture.
1 <https://chromestatus.com/feature/5179186249465856>
Also note that focus may become another threat with
folding screens which now have an open possible with
focus that could be major confusion.
Peace ..tom jones
On Mon, Oct 19, 2026 at 11:16 AM Alex Russell
<[email protected]> wrote:
LGTM1, pending test updates and such.
On Thursday, October 15, 2026 at 2:56:08 PM UTC-7
[email protected] wrote:
Thank you Philip for taking a look. Yes this test
matches the spec, but it fails because blink
blocks autofocus in cross-origin frames even when
the policy is allowed. I'm working on updating
the implementation to make this work, I will let
you know when that's done and the test passes again.
Thanks,
Fernando
On Thursday, October 15, 2026 at 2:04:15 AM UTC-7
Philip Jägenstedt wrote:
https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled.sub.html?label=master&label=experimental&aligned&q=focus-without
<https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled.sub.html?label=master&label=experimental&aligned&q=focus-without>
is failing, does this test match the spec and
if so is the plan to make it pass before
shipping?
On Wed, Oct 14, 2026 at 7:49 PM 'Fernando
Fiori' via blink-dev <[email protected]>
wrote:
*Contact emails*
[email protected],
[email protected],
[email protected],
[email protected], [email protected]
*Explainer*
https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md
<https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md>
*Specification*
https://html.spec.whatwg.org/#focus-without-user-activation-feature
<https://html.spec.whatwg.org/#focus-without-user-activation-feature>
*Summary*
Gives embedders control over programmatic
focus from embedded content via the
`focus-without-user-activation`
permissions policy. When the policy is
denied for the initiating frame,
programmatic focus changes (from
`element.focus()`, `autofocus`,
`window.focus()`, and the focusing steps
for dialogs and popovers) are blocked
unless that frame has transient user
activation or focus is already within its
subtree. This does not prevent dialogs or
popovers from opening. User-initiated
focus such as clicking or tabbing is
never affected. The policy can be set via
a `Permissions-Policy` HTTP response
header or the iframe `allow` attribute.
Focus delegation is supported: a parent
frame that has focus can programmatically
pass focus to a child iframe, even if the
child has the policy denied, and once a
frame has focus it can move focus within
its own subtree.
*Blink component*
Blink>FeaturePolicy
<https://issues.chromium.org/issues?q=customfield1222907:%22Blink%3EFeaturePolicy%22>
*Web Feature ID*
Missing feature
*Motivation*
Embedded third-party content such as ads,
widgets, and iframes can programmatically
steal input focus from the top-level page
without any user interaction, silently
redirecting keystrokes and creating
security and accessibility problems. This
was originally reported by engineers
working on advertising security for large
publishers. Today developers have no
reliable way to prevent it: the sandbox
attribute disables JavaScript entirely,
breaking most embedded content, and
JavaScript focus-reclaiming hacks using
blur listeners or polling are unreliable,
cause visible focus flickering, and do
not scale across multiple iframes. This
policy provides fine-grained, declarative
control over programmatic focus from
embedded content.
*Initial public proposal*
https://github.com/w3c/webappsec-permissions-policy/issues/273
<https://github.com/w3c/webappsec-permissions-policy/issues/273>
*Search tags*
focus-without-user-activation
<https://chromestatus.com/features#tags:focus-without-user-activation>,
focus
<https://chromestatus.com/features#tags:focus>,
permissions policy
<https://chromestatus.com/features#tags:permissions%20policy>
*TAG review*
https://github.com/w3ctag/design-reviews/issues/1066
<https://github.com/w3ctag/design-reviews/issues/1066>
*TAG review status*
Issues addressed
*Origin Trial Name*
focus-without-user-activation Permissions
Policy
*Goals for experimentation*
Validate the current API design and get
feedback on whether it satisfies
developer needs in real life use cases.
*Chromium Trial Name*
BlockingFocusWithoutUserActivation
*Link to origin trial feedback summary*
https://groups.google.com/a/chromium.org/g/blink-dev/c/GLmp1IrJ4Ig/m/WSWz-Iv5AgAJ
<https://groups.google.com/a/chromium.org/g/blink-dev/c/GLmp1IrJ4Ig/m/WSWz-Iv5AgAJ>
*Origin Trial documentation link*
https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md
<https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md>
*WebFeature UseCounter name*
kFocusWithoutUserActivationPolicySet
*Risks*
*Interoperability and Compatibility*
/Gecko/: No
signal
(https://github.com/mozilla/standards-positions/issues/1080
<https://github.com/mozilla/standards-positions/issues/1080>)
/WebKit/:
Support
(https://github.com/WebKit/standards-positions/issues/406
<https://github.com/WebKit/standards-positions/issues/406>)
/Web developers/:
Positive
(https://github.com/w3c/webappsec-permissions-policy/issues/273
<https://github.com/w3c/webappsec-permissions-policy/issues/273>) Several
comments on that thread expressing web
developer support.
/Other signals/:
*WebView application risks*
/Does this intent deprecate or change
behavior of existing APIs, such that it
has potentially high risk for Android
WebView-based applications?/
No impact on WebView applications. The
policy shipping with a default of allow *
would avoid breaking any webapp that uses
focus APIs and make it an opt-in feature
for web developers. Also the
implementation has a base::Feature
(BlockingFocusWithoutUserActivation)
killswitch that can be flipped off in
case of compat issues.
*Debuggability*
There are console messages when focus
movement is blocked by this permissions
policy to help developers debug their
implementations related to this feature.
*Will this feature be supported on all
six Blink platforms (Windows, Mac, Linux,
ChromeOS, Android, and Android WebView)?*
Yes
*Is this feature fully tested by
web-platform-tests
<https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md>?*
Yes
https://wpt.fyi/results/permissions-policy/experimental-features?label=master&label=experimental&aligned&q=focus-without
<https://wpt.fyi/results/permissions-policy/experimental-features?label=master&label=experimental&aligned&q=focus-without>
*Flag name on about://flags*
blocking-focus-without-user-activation
*Finch feature name*
BlockingFocusWithoutUserActivation
*Rollout plan*
Will ship enabled for all users
*Requires code in //chrome?*
False
*Tracking bug*
https://crbug.com/40095111
*Measurement*
Added UseCounters
FocusWithoutUserActivation*:
FocusWithoutUserActivationAllowedByPolicy:
https://chromestatus.com/metrics/feature/timeline/popularity/5873
<https://chromestatus.com/metrics/feature/timeline/popularity/5873>
FocusWithoutUserActivationAllowedByDescendant:
https://chromestatus.com/metrics/feature/timeline/popularity/5874
<https://chromestatus.com/metrics/feature/timeline/popularity/5874>
FocusWithoutUserActivationBlocked:
https://chromestatus.com/metrics/feature/timeline/popularity/5875
<https://chromestatus.com/metrics/feature/timeline/popularity/5875>
FocusWithoutUserActivationPolicySet:
https://chromestatus.com/metrics/feature/timeline/popularity/5876
<https://chromestatus.com/metrics/feature/timeline/popularity/5876>
They were added in this CL:
https://chromium-review.googlesource.com/c/chromium/src/+/7770268
<https://chromium-review.googlesource.com/c/chromium/src/+/7770268>
*Adoption expectation*
Microsoft Teams has already adopted the
`focus-without-user-activation`
permissions policy and rolled it out in
public preview. They're expected to use
the feature by default as soon as it ships.
*Adoption plan*
Microsoft Teams has rolled out the policy
in public preview and plans to enable it
by default once it ships.
*Estimated milestones*
Shipping on desktop
158
Origin trial desktop first
149
Origin trial desktop last
152
Shipping on Android
158
Origin trial Android first
149
Origin trial Android last
152
Shipping on WebView
158
Origin trial WebView first
149
Origin trial WebView last
152
*Anticipated spec changes*
/Open questions about a feature may be a
source of future web compat or interop
issues. Please list open issues (e.g.
links to known github issues in the
project for the feature specification)
whose resolution may introduce web
compat/interop risk (e.g., changing to
naming or structure of the API in a
non-backward-compatible way)./
https://github.com/whatwg/html/pull/11519
<https://github.com/whatwg/html/pull/11519>
*Link to entry on the Chrome Platform Status*
https://chromestatus.com/feature/5179186249465856?gate=4630319955705856
<https://chromestatus.com/feature/5179186249465856?gate=4630319955705856>
*Links to previous Intent discussions*
Intent to Experiment:
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/69d6e35a.050a0220.1c79a0.0dc6.GAE%40google.com
<https://groups.google.com/a/chromium.org/d/msgid/blink-dev/69d6e35a.050a0220.1c79a0.0dc6.GAE%40google.com>
This intent message was generated by
Chrome Platform Status
<https://chromestatus.com/>.
--
You received this message because you are
subscribed to the Google Groups
"blink-dev" group.
To unsubscribe from this group and stop
receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CH3PR00MB2480A0093FF93B090CE7DFDADC9D2%40CH3PR00MB2480.namprd00.prod.outlook.com
<https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CH3PR00MB2480A0093FF93B090CE7DFDADC9D2%40CH3PR00MB2480.namprd00.prod.outlook.com?utm_medium=email&utm_source=footer>.
--
You received this message because you are subscribed
to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving
emails from it, send an email to
[email protected].
To view this discussion visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/25748a7d-275a-450d-9a83-d3841faffa44n%40chromium.org
<https://groups.google.com/a/chromium.org/d/msgid/blink-dev/25748a7d-275a-450d-9a83-d3841faffa44n%40chromium.org?utm_medium=email&utm_source=footer>.
--
You received this message because you are subscribed to the
Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from
it, send an email to [email protected].
