Google Chrome's integrated anti-abuse systems are currently blocking an average of 7 billion unwanted Android push notifications daily, according to figures released by Google for the first quarter of this year. These protections are a multi-layered effort combining Chrome Security, Firebase Cloud Messaging (FCM), and Safe Browsing to detect and prevent malicious or deceptive content throughout the notification lifecycle.
A key component of these measures involves automatically revoking notification permissions for websites identified as engaging in abusive practices or those with which users have not recently interacted. Google Safe Browsing flags sites involved in scams, phishing, and other deceptive content. Users retain the ability to review and restore these permissions through Chrome's Safety Hub if they deem a website trustworthy.
To combat coordinated networks of abusive websites, Google has developed behavioral detection capabilities. This system analyzes service worker activity to identify groups of sites distributing malware, scams, and other malicious content. This allows for the proactive revocation of permissions from persistent bad actors, even if the individual site content might not immediately appear malicious.
Further enhancing these protections, Firebase Cloud Messaging (FCM) imposes a rate limit of 1,000 push messages per minute for websites. Domains that exceed this threshold receive HTTP 429 responses. Repeat offenders face stricter rate limits until they demonstrate sustained non-disruptive behavior, a measure designed to curb large-scale notification abuse while still allowing legitimate sites to use push notifications.
Chrome has also updated its permission model to give users more control over browser alerts. This includes a redesigned Android permission prompt intended to reduce interruptions and help users make more informed decisions. Additionally, a one-tap unsubscribe feature allows users to quickly revoke notification permissions from websites sending unwanted or excessive alerts.
