According to Google, Chrome’s anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day in the first quarter of 2026.
In a new one Blog postGoogle argues that misuse of notifications is increasingly being used to spread fraud, malware, phishing attempts and fraudulent payment requests.
To curb abuse, Google has developed a “Swiss cheese” defense model, in which multiple overlapping systems attempt to stop abuse at different stages.
“Our goal is to ensure that when abuse slips through one layer, another is there to catch it,” Google said.
“This approach allows us to stop abuse at the source and prevent fraudulent content from reaching users, while maintaining a healthy balance between utility and security.”
Chrome can automatically revoke notification permissions
Chrome already removes notification permissions from inactive websites as well as websites that repeatedly trigger warnings about suspicious notifications.
When Chrome revokes permission, it can automatically unsubscribe you from a website’s notifications.
Source: Google
According to Google, users can still review these automatically revoked permissions in the Safety Hub and grant access again if necessary.
You also have the option to unsubscribe from notifications directly from Android’s notification panel, as shown below.
In addition to giving you greater control, Google analyzes behavior across networks of related websites, including coordinated activity by service workers, to identify groups spreading malicious or misleading notifications.
“This allows us to proactively revoke permissions from these persistent attackers, protecting users from misleading notifications even when the site content does not appear to be inherently malicious,” Google said.
Google considers factors such as notification volume, time users spend on a site, frequency of permission requests, and engagement.
For example, websites classified as disruptive can be limited to 1,000 messages per minute, with excess requests returning an HTTP 429 error.
According to Google, these restrictions may become more aggressive for repeat offenders and may only be reset after a period of trouble-free behavior.
Chrome has also changed the way notification permission prompts work on Android, with a less intrusive interface that allows users to decide whether they want notifications without interrupting their browsing.
“This strategy has significantly reduced unnecessary background activity, reduced battery consumption on user devices, and transformed the notification lifecycle so that users only receive the content they find truly valuable,” the company noted.
If you use Chrome, you can check the notification permissions below Settings > Privacy and Security > Site Settings > Notifications on the desktop, or Settings > Notifications on Android.
Overall prevention scores can hide what happens after the first access. Once attackers use valid credentials, prevention drops sharply.
The 2026 Blue Report measures defense technology for technology in 338 million simulations conducted in customer production environments.
