Google announced that the anti-abuse systems built into Chrome have managed to reduce over 7 billion per day unwanted notifications on Chrome for Android during the first quarter of 2026. The figure, published on August 11, 2026, in a Google blog post titled “The multi-layered defenses that harden Chrome against abusive notifications”, illustrates the extent of a problem that has long been underestimated: browser notifications, which have become a favored vector for scams, phishing, malware distribution, and fraudulent payment requests.

A "swiss cheese" defensive model

To curb the phenomenon, Google says it has adopted a defense model referred to as “Swiss cheese”: several systems overlap and attempt to stop abuse at different stages. “Our goal is to ensure that if an abuse passes through one layer, another is there to intercept it,” explains the company, adding that this approach allows stopping abuse at the source “while maintaining a healthy balance between utility and security.”

In practice, several mechanisms work in parallel: automatic permission revocation, analysis of site networks, rate limiting, and a redesign of the permission request interface.

Automatic revocation and Safety Hub

Chrome already removes notification permissions from inactive sites, as well as from sites that repeatedly trigger “suspicious notification” warnings. When the browser revokes permission, it can automatically unsubscribe the user from notifications from the site in question.

Google specifies that users can view the permissions that have been revoked in Chrome's Safety Hub and reactivate them if they wish. On Android, it is also possible to unsubscribe directly from the system notification panel.

Targeting networks, not just sites

Beyond the individual behavior of a site, Google now analyzes behavior across networks of related sites, including the coordinated activity of service workers (scripts that run in the background and allow a site to send notifications even when the tab is closed). The goal is to identify groups distributing misleading or malicious notifications.

“This allows us to proactively revoke permissions from these persistent bad actors, protecting users from misleading notifications even when the site’s content doesn’t seem inherently malicious,” Google states. The criteria analyzed include notification volume, time spent by users on the site, frequency of permission requests, and engagement.

Rate limiting: 1,000 messages per minute, then HTTP 429

On the technical side, Google has implemented a rate-limiting system. Sites classified as disruptive can be restricted to 1,000 messages per minute, with excessive requests receiving an HTTP 429 (Too Many Requests) error in response. These restrictions can become more severe for repeat offenders and are only reset after a period of non-disruptive behavior.

A less intrusive permission request

Chrome has also changed the way notification permission requests are displayed on Android, with a less disruptive interface designed to let users decide without interrupting their browsing. Google claims this strategy has “significantly reduced unnecessary background activity, decreased device battery consumption, and transformed the notification lifecycle so that users only receive content they find truly useful.”

A fight that began in 2020

The current offensive is part of a continued effort that Google has been undertaking for over six years. Starting in January 2020, with Chrome 80, the browser introduced a “quieter notification permission UI” that reduced the intrusiveness of requests, especially for users who consistently deny notifications and for sites with very low acceptance rates.

In May 2020, then with Chrome 84 (released in July 2020), Google ramped up its efforts by deploying protection against abusive notifications: sites with deceptive practices — forced requests, fake dialog boxes mimicking system messages, notifications used for phishing or distributing malware — were automatically enrolled in the discreet interface, with a warning stating that the site might attempt to deceive the user. Google then recalled that abusive notification requests were among the top complaints from Chrome users, with a significant portion of the volume coming from a small number of malicious sites — a finding that the 2026 figures confirm on a spectacular scale.

Why notifications have become a vector for abuse

The reason why browser notifications are so appealing to cybercriminals lies in their technical functioning: once permission is granted, a site can rely on a service worker to push notifications even when the user has closed the tab or is no longer using the site. This persistent channel, which resembles a classic application notification in the system panel, is ideal for disseminating scams (fake viruses, fake offers, fake payment requests) with a deceptively official appearance.

This is precisely what the Google post aims to counter by addressing not just a site's content, but the infrastructure (networks of sites and the coordinated activity of service workers), marking a shift in approach compared to the 2020 protections that mainly targeted individual sites.

What users can do

On the ground, a few simple checks allow users to regain control:

  • On computer: Settings > Privacy and security > Site settings > Notifications.
  • On Android: Settings > Notifications in Chrome, or directly from the system notification panel to unsubscribe from a site.
  • Chrome's Safety Hub lists automatically revoked permissions and allows for their restoration if needed.

Google also urges legitimate webmasters to follow best practices: do not request permission on the first visit, but at a contextually relevant moment — a recommendation already made in 2020 and which the new rate limiting now makes costly to ignore.

Sources: Google (post “The multi-layered defenses that harden Chrome against abusive notifications”, August 11, 2026, shared by BleepingComputer); BleepingComputer; Chromium Blog (2020); ZDNET (2020).