Google says Chrome's anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day during the first quarter of 2026.
In a new blog post, Google argues that notification abuse has increasingly been used to distribute scams, malware, phishing attempts, and fraudulent payment requests.
To reduce the abuse, Google developed a "Swiss cheese" defense model, where several overlapping systems try to stop abuse at different stages.
"Our goal is to ensure that if abuse slips through one layer, another is there to catch it," Google explained.
"This approach allows us to halt abuse at the source, preventing deceptive content from reaching users while maintaining a healthy balance between utility and security."
Chrome can automatically revoke notification permissions
Chrome already removes notification permissions from inactive websites, as well as sites that repeatedly trigger suspicious-notification warnings.
When Chrome revokes the permission, it can automatically unsubscribe you from a site's notifications.
Google says users can still review these automatically revoked permissions in Safety Hub and grant access again if they want to.
You also have the ability to unsubscribe from notifications directly from Android's notifications panel, as shown below.
In addition to giving you greater control, Google is analyzing behavior across networks of related websites, including coordinated service-worker activity, to identify groups distributing malicious or deceptive notifications.
"This enables us to proactively revoke permissions from these persistent bad actors, protecting users from deceptive notifications even when the site content might not seem inherently malicious," Google said.
Google looks at factors such as notification volume, time users spend on a site, permission-prompt frequency, and engagement.
For example, sites classified as disruptive can be limited to 1,000 messages per minute, with excess requests returning an HTTP 429 error.
Google says these restrictions can become more aggressive for repeat offenders and are only reset after a period of non-disruptive behavior.
Chrome has also changed how notification permission prompts work on Android, with a less disruptive interface designed to let users decide whether they want notifications without interrupting their browsing.
"This strategy has substantially decreased unnecessary background activity, reduced user device battery consumption, and transformed the notification lifecycle so users receive only the content they find truly valuable," the company noted.
If you use Chrome, you can review notification permissions under Settings > Privacy and security > Site Settings > Notifications on desktop, or Settings > Notifications on Android.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now