)]}'
{"id": 5179186249465856, "name": "Permissions Policy: focus-without-user-activation", "summary": "Gives embedders control over programmatic focus from embedded content via the `focus-without-user-activation` permissions policy. When the policy is denied for the initiating frame, programmatic focus changes (from `element.focus()`, `autofocus`, `window.focus()`, and the focusing steps for dialogs and popovers) are blocked unless that frame has transient user activation or focus is already within its subtree. This does not prevent dialogs or popovers from opening. User-initiated focus such as clicking or tabbing is never affected. Chromium's existing restriction on autofocus in cross-origin iframes is unchanged: the policy can further restrict autofocus, but allowing it does not enable autofocus in a cross-origin frame.\n\nThe policy can be set via a `Permissions-Policy` HTTP response header or the iframe `allow` attribute. Focus delegation is supported: a parent frame that has focus can programmatically pass focus to a child iframe, even if the child has the policy denied, and once a frame has focus it can move focus within its own subtree.", "markdown_fields": [], "blink_components": ["Blink>FeaturePolicy"], "star_count": 110, "search_tags": ["focus-without-user-activation", "focus", "permissions policy"], "created": {"by": "ekaramad@google.com", "when": "2019-05-20 21:29:46.529640"}, "updated": {"by": "ffiori@microsoft.com", "when": "2026-10-21 21:36:12.357096"}, "category": "Miscellaneous", "category_int": 2, "feature_notes": "Initially proposed by developers as an issue on permissions-policy repo:\n\nhttps://github.com/w3c/webappsec-permissions-policy/issues/273", "web_feature": "Missing feature", "is_official_web_feature": false, "webdx_usecounter_enum": null, "enterprise_feature_categories": [], "enterprise_product_category": 0, "is_releasenotes_content_reviewed": false, "is_releasenotes_publish_ready": false, "stages": [{"id": 5232717298401280, "created": "2019-05-20 21:29:46.529640", "feature_id": 5179186249465856, "stage_type": 110, "display_name": null, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5080093018292224, "created": "2019-05-20 21:29:46.529640", "feature_id": 5179186249465856, "stage_type": 120, "display_name": null, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 4758114956476416, "created": "2019-05-20 21:29:46.529640", "feature_id": 5179186249465856, "stage_type": 130, "display_name": null, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 4905074113904640, "created": "2019-05-20 21:29:46.529640", "feature_id": 5179186249465856, "stage_type": 140, "display_name": null, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 4891783733968896, "created": "2019-05-20 21:29:46.529640", "feature_id": 5179186249465856, "stage_type": 150, "display_name": "focus-without-user-activation Permissions Policy", "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/d/msgid/blink-dev/69d6e35a.050a0220.1c79a0.0dc6.GAE%40google.com", "announcement_url": null, "experiment_goals": "Validate the current API design and get feedback on whether it satisfies developer needs in real life use cases.", "experiment_risks": "None.", "origin_trial_id": "1028509564900737025", "origin_trial_feedback_url": "https://groups.google.com/a/chromium.org/g/blink-dev/c/GLmp1IrJ4Ig/m/WSWz-Iv5AgAJ", "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": "BlockingFocusWithoutUserActivation", "ot_description": "Gives embedders control over programmatic focus from embedded content via the focus-without-user-activation permissions policy. When the policy is denied for a frame, programmatic focus calls (element.focus(), autofocus, window.focus(), dialog.showModal(), and popover focusing) are blocked unless triggered by user activation or focus is being delegated.", "ot_display_name": "focus-without-user-activation Permissions Policy", "ot_documentation_url": "https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md", "ot_emails": ["ffiori@microsoft.com", "leolee@microsoft.com"], "ot_feedback_submission_url": "https://github.com/whatwg/html/issues?q=%22focus-without-user-activation%22", "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": "masonfreed@google.com", "ot_requester_email": "daniec@chromium.org", "ot_require_approvals": false, "ot_use_counter_bucket_number": 5876, "ot_webfeature_use_counter": "kFocusWithoutUserActivationPolicySet", "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": 149, "android_first": 149, "ios_first": null, "webview_first": 149, "desktop_last": 152, "android_last": 152, "ios_last": null, "webview_last": 152, "ot_setup_status": 6}, {"id": 6264577151467520, "created": "2019-05-20 21:29:46.529640", "feature_id": 5179186249465856, "stage_type": 160, "display_name": null, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CH3PR00MB2480A0093FF93B090CE7DFDADC9D2%40CH3PR00MB2480.namprd00.prod.outlook.com", "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": 158, "android_first": 158, "ios_first": null, "webview_first": 158, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}], "accurate_as_of": "2026-10-08 17:11:22.338161", "creator_email": "ekaramad@google.com", "updater_email": "ffiori@microsoft.com", "owner_emails": ["ekaramad@chromium.org", "iclelland@chromium.org", "mustaq@chromium.org", "ffiori@microsoft.com", "leo.lee@microsoft.com"], "editor_emails": [], "cc_emails": [], "spec_mentor_emails": [], "unlisted": false, "deleted": false, "editors": [], "cc_recipients": [], "spec_mentors": [], "creator": "ekaramad@google.com", "feature_type": "New or changed feature", "feature_type_int": 0, "intent_stage": "Start prototyping", "intent_stage_int": 1, "active_stage_id": 6264577151467520, "bug_url": "https://crbug.com/40095111", "launch_bug_url": null, "new_crbug_url": "https://bugs.chromium.org/p/chromium/issues/entry?components=Blink>FeaturePolicy&blocking=40095111&cc=ekaramad@chromium.org,iclelland@chromium.org,mustaq@chromium.org,ffiori@microsoft.com,leo.lee@microsoft.com", "screenshot_links": [], "first_enterprise_notification_milestone": null, "enterprise_impact": 1, "breaking_change": false, "confidential": false, "shipping_year": 2026, "flag_name": "blocking-focus-without-user-activation", "finch_name": "BlockingFocusWithoutUserActivation", "non_finch_justification": null, "ongoing_constraints": "None.", "rollout_plan": 0, "rollout_plan_displayname": "Will ship enabled for all users", "motivation": "Embedded third-party content such as ads, widgets, and iframes can programmatically steal input focus from the top-level page without any user interaction, silently redirecting keystrokes and creating security and accessibility problems. This was originally reported by engineers working on advertising security for large publishers.\n\nToday developers have no reliable way to prevent it: the sandbox attribute disables JavaScript entirely, breaking most embedded content, and JavaScript focus-reclaiming hacks using blur listeners or polling are unreliable, cause visible focus flickering, and do not scale across multiple iframes. This policy provides fine-grained, declarative control over programmatic focus from embedded content.", "devtrial_instructions": null, "activation_risks": "", "measurement": "Added UseCounters FocusWithoutUserActivation*:\n\nFocusWithoutUserActivationAllowedByPolicy: https://chromestatus.com/metrics/feature/timeline/popularity/5873\n\nFocusWithoutUserActivationAllowedByDescendant: https://chromestatus.com/metrics/feature/timeline/popularity/5874\n\nFocusWithoutUserActivationBlocked: https://chromestatus.com/metrics/feature/timeline/popularity/5875\n\nFocusWithoutUserActivationPolicySet: https://chromestatus.com/metrics/feature/timeline/popularity/5876\n\nThey were added in this CL: https://chromium-review.googlesource.com/c/chromium/src/+/7770268\n", "availability_expectation": null, "adoption_expectation": "Microsoft Teams has already adopted the `focus-without-user-activation` permissions policy and rolled it out in public preview. They're expected to use the feature by default as soon as it ships.", "adoption_plan": "Microsoft Teams has rolled out the policy in public preview and plans to enable it by default once it ships.", "initial_public_proposal_url": "https://github.com/w3c/webappsec-permissions-policy/issues/273", "explainer_links": ["https://github.com/ffiori/webappsec-permissions-policy/blob/focus-without-user-activation-explainer/policies/focus-without-user-activation.md"], "requires_embedder_support": false, "spec_link": "https://html.spec.whatwg.org/#focus-without-user-activation-feature", "api_spec": false, "automation_spec": false, "interop_compat_risks": " ", "all_platforms": true, "all_platforms_descr": "", "non_oss_deps": null, "anticipated_spec_changes": "PR in review to refine the current spec related to the policy and focus: https://github.com/whatwg/html/pull/11519\n\nDiscussion whether allowing the policy should lift the cross-origin autofocus restriction (Chromium preserves this restriction until this is resolved): https://github.com/whatwg/html/issues/13105", "security_risks": "", "ergonomics_risks": "", "wpt": true, "wpt_descr": "https://wpt.fyi/results/permissions-policy/experimental-features?label=master&label=experimental&aligned&q=focus-without", "webview_risks": "No impact on WebView applications. The policy shipping with a default of allow * would avoid breaking any webapp that uses focus APIs and make it an opt-in feature for web developers.\n\nAlso the implementation has a base::Feature (BlockingFocusWithoutUserActivation) killswitch that can be flipped off in case of compat issues.", "devrel_emails": [], "debuggability": "There are console messages when focus movement is blocked by this permissions policy to help developers debug their implementations related to this feature.\n\n", "doc_links": [], "sample_links": [], "prefixed": false, "tags": ["focus-without-user-activation", "focus", "permissions policy"], "tag_review": " https://github.com/w3ctag/design-reviews/issues/1066", "tag_review_status": "Issues addressed", "tag_review_status_int": 3, "security_review_status": "Pending", "security_review_status_int": 1, "privacy_review_status": "Pending", "privacy_review_status_int": 1, "security_continuity_id": null, "security_launch_issue_id": null, "updated_display": null, "resources": {"samples": [], "docs": []}, "comments": "Initially proposed by developers as an issue on permissions-policy repo:\n\nhttps://github.com/w3c/webappsec-permissions-policy/issues/273", "ff_views": 5, "safari_views": 3, "web_dev_views": 2, "browsers": {"chrome": {"bug": "https://crbug.com/40095111", "blink_components": ["Blink>FeaturePolicy"], "devrel": [], "owners": ["ekaramad@chromium.org", "iclelland@chromium.org", "mustaq@chromium.org", "ffiori@microsoft.com", "leo.lee@microsoft.com"], "origintrial": false, "prefixed": false, "flag": true, "status": {"text": "In developer trial (Behind a flag)", "val": 4, "milestone_str": "158"}, "announced": true, "desktop": 158, "android": 158, "webview": 158, "ios": null}, "ff": {"view": {"url": "https://github.com/mozilla/standards-positions/issues/1080", "notes": "", "text": "No signal", "val": 5}}, "safari": {"view": {"url": "https://github.com/WebKit/standards-positions/issues/406", "notes": "", "text": "Support", "val": 3}}, "webdev": {"view": {"text": "Positive", "val": 2, "url": "https://github.com/w3c/webappsec-permissions-policy/issues/273", "notes": "Several comments on that thread expressing web developer support."}}, "other": {"view": {"text": null, "val": null, "url": null, "notes": null}}}, "standards": {"spec": "https://html.spec.whatwg.org/#focus-without-user-activation-feature", "maturity": {"text": "Specification currently under development in a Working Group", "short_text": "Working draft", "val": 4}}, "is_released": true, "is_enterprise_feature": false, "experiment_timeline": "", "ai_test_eval_report": null, "ai_test_eval_run_status": null, "ai_test_eval_status_timestamp": null}