Google stated that Chrome protection systems blocked more than 7 billion unwanted notifications daily on Android throughout the first quarter of 2026. Websites have increasingly turned to browser notifications to push phishing pages, fraudulent payment requests, malware downloads, and other unsolicited content.
Chrome employs a layered "Swiss cheese" defense strategy in which multiple protective mechanisms overlap to cover gaps left by any single filter. If a suspicious notification bypasses one layer, subsequent filters are designed to catch it. The browser can automatically revoke notification permissions from sites that have not been visited for a long time or that frequently trigger security warnings. When permission is withdrawn, Chrome can also cancel any active subscription associated with the site.
Users who wish to restore access can do so through the Safety Hub section. Protection mechanisms evaluate not only individual sites but also related networks and coordinated activity involving service workers. Key signals include message volume, frequency of permission requests, user dwell time, and actual engagement levels.
Resources classified as overly intrusive face a strict limit of 1,000 messages per minute; any traffic exceeding this threshold receives an HTTP 429 response. Repeat offenders encounter tighter restrictions that are lifted only after a sustained period of compliant behavior. On Android, Google also redesigned permission request dialogs to be less intrusive, resulting in lower background activity and reduced battery consumption.
Users can review which sites are allowed to send notifications in desktop Chrome via Settings → Privacy and security → Site settings → Notifications. On Android the equivalent controls are located under Settings → Notifications.
