Google Chrome Blocks Abusive Notifications Used to Deliver Malware and Scams

Google Chrome has implemented enhanced defenses aimed at disrupting abusive web push notifications that are often used to distribute malware, phishing attempts, fraudulent payment requests, and scam content.

This initiative combines browser-based permission controls, backend rate limiting, Safe Browsing intelligence, and behavioural analysis to minimise notification abuse while still allowing legitimate websites to use the feature.

Google Chrome Blocks Abusive Notifications

Push notifications have traditionally enabled real-time engagement between websites and users. However, malicious actors are increasingly exploiting notification permissions through misleading prompts, compromised websites, and coordinated domains to deliver deceptive alerts directly to users’ devices.

These messages may impersonate antivirus warnings, software update notices, delivery services, banks, or cryptocurrency platforms, leading users to malicious downloads and credential-harvesting pages.

According to Chrome Security, these new defenses have reduced unwanted notifications on Android by over 7 billion per day during the first quarter alone.

Instead of relying on a single detection method, the company has adopted a multi-layered approach, described as a “Swiss cheese” model, which involves overlapping controls designed to catch abuse at various stages of the notification lifecycle.

A key component of this strategy is automated permission revocation. Chrome can revoke notification permissions for sites that users have not interacted with recently, thereby limiting the long-term effectiveness of permissions obtained through social engineering.

Additionally, permissions may be removed from sites that repeatedly trigger suspicious notification warnings. Users can still review and restore revoked permissions via Chrome’s Safety Hub.

Google has also developed behavioral detection mechanisms to identify coordinated networks of abusive websites. These mechanisms analyze signals related to service worker activity, searching for patterns that suggest multiple domains are collaborating to deliver malicious or unwanted notifications.

This allows Chrome to revoke permissions from infrastructures associated with malware distribution and scam activities, even if an individual website does not seem immediately harmful.

On the backend, Firebase Cloud Messaging has introduced Push API rate limits to mitigate high-volume notification abuse.

Chrome evaluates domains based on factors such as notification volume relative to user engagement, frequency of permission prompts, and overall site activity.

Domains deemed disruptive are limited to sending 1,000 messages per minute. Attempts to exceed this threshold will result in HTTP 429 responses, forcing operators to reduce their traffic.

The restrictions escalate for repeat offenders and reset only after a sustained period of non-disruptive behavior. This model increases the operational costs for running large-scale notification spam campaigns while still allowing legitimate publishers to adapt their delivery methods.

Additionally, Chrome has modified the permission-granting experience, especially on Android, to reduce prompt fatigue and assist users in making more informed decisions.

The browser previously introduced a one-tap unsubscribe feature for Android, enabling users to quickly revoke notification permissions from sites that become intrusive or suspicious.

These changes address a persistent delivery channel that cybercriminals have used to circumvent traditional email security measures, allowing them to reach victims through browser alerts.

By combining permission governance, behavioral detection, reputation signals, and server-side throttling, Google aims to make notification-based malware and scam campaigns increasingly difficult to scale.

Users should periodically review their website notification permissions in Chrome settings. On desktop, permissions can be accessed via Settings > Privacy and security > Site Settings > Notifications or by visiting chrome://settings/content/notifications. Android users can check permissions by navigating through More > Settings > Notifications.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world