Permissions Policy: focus-without-user-activation

at a glance

why it exists

Embedded third-party iframes can steal focus from the embedding page by calling element.focus() or triggering an autofocus attribute without any user interaction. This is disruptive in embed-heavy layouts (dashboards, ad slots, widget galleries) where unexpected focus shifts break keyboard navigation and screen-reader context.

The focus-without-user-activation policy gives the embedding page control: when the policy is denied for a frame, all programmatic focus calls inside that frame are silently ignored unless a user gesture has occurred first. User-initiated focus (clicking, tabbing) is never affected — the policy only blocks programmatic focus without a prior activation.

Focus delegation is still supported: a parent frame that currently has focus can transfer it programmatically to a child iframe even if the child has the policy denied.

shape of the API

Focus calls blocked when denied: element.focus(), autofocus attribute, window.focus(), dialog.showModal(), popover focusing.

Never blocked: user-initiated focus (click, tab key, touch).

example

<!-- Deny programmatic focus for an embedded iframe -->
<iframe
  src="https://widget.example.com"
  allow="focus-without-user-activation 'none'"
></iframe>

<!-- Via HTTP response header (applies to all child frames) -->
<!-- Permissions-Policy: focus-without-user-activation=() -->

<!-- Focus delegation still works: parent transfers focus to iframe -->
<iframe id="child" src="https://widget.example.com"
        allow="focus-without-user-activation 'none'"></iframe>
<script>
  // This works — parent delegates focus to child
  document.getElementById('child').focus();
  // Inside the iframe, element.focus() is then allowed within the child's subtree
</script>

browser support

see also

• Chrome Platform Status — Permissions Policy: focus-without-user-activation
• gendn — v149: Permissions Policy: focus-without-user-activation (earlier entry)