Loading story…
Google said Chrome's anti-abuse protections blocked more than 7 billion unwanted web notifications per day on Android in the first quarter of 2026, targeting a channel widely used for scams, phishing, malware delivery, and fraudulent payment requests. The company said its layered defense model combines Chrome Security, Safe Browsing, and Firebase Cloud Messaging (FCM) to detect and disrupt abusive notification activity before it reaches users.
Chrome now automatically revokes notification permissions for inactive sites and for domains repeatedly flagged for suspicious or deceptive behavior, while also analyzing related site networks and coordinated service worker activity to identify persistent bad actors and revoke permissions proactively. Google said it also rate-limits disruptive domains to 1,000 notifications per minute, returning HTTP 429 for excess requests, applies stricter controls to repeat offenders, redesigned Android notification permission prompts to reduce abuse and background activity, and added user-facing controls including Safety Hub review options and one-tap unsubscribe.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google said Chrome's anti-abuse systems reduced or blocked more than 7 billion unwanted notifications per day on Android during the first quarter of 2026. The company tied the result to its layered defenses against abusive web push notifications.
Google changed Chrome's Android notification permission prompt to a less disruptive design and added simpler user controls, including direct unsubscribe options for unwanted site notifications. Google said the revised approach reduced unnecessary background activity and battery consumption.
Google said sites classified as disruptive are limited to 1,000 notification messages per minute, with excess requests receiving HTTP 429 responses and stricter restrictions for repeat offenders. The controls were presented as a way to reduce large-scale abuse while allowing legitimate notification use to continue.
Google said Chrome now analyzes behavior across related websites, including coordinated service-worker activity, to identify persistent abusive notification actors and proactively revoke their permissions. The detection stack was described as combining Chrome Security, Safe Browsing, and Firebase Cloud Messaging.
Google introduced Chrome protections that automatically revoke notification permissions for inactive websites and for sites identified as abusive or deceptive, with users able to review or restore revoked permissions in Safety Hub. The changes were described as part of Chrome's effort to curb scams, phishing, malware, and other abusive web push notifications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecysecurity.news
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers said a threat operation dubbed **Pushpaganda** manipulated Google Discover on Android and Chrome to lure users into enabling malicious browser push notifications. The campaign relied on **113 actor-controlled domains** publishing AI-generated, sensational news pages that mimicked legitimate content and used social-engineering themes including fake government deposits, tax notices, arrest warrants, missed calls, and bank alerts. HUMAN’s Satori Threat Intelligence and Research Team reported the activity first focused on India before expanding to Australia, the United States, and other regions. Once users landed on the pages, deceptive prompts and buttons pushed them to subscribe to notifications, while JavaScript-based tab rotation opened additional domains to inflate traffic and advertising revenue. At its peak, the operation generated roughly **240 million bid requests in seven days**, indicating a large-scale ad fraud component alongside the notification abuse. Researchers shared the infrastructure with Google, which said it deployed a fix to prevent this type of manipulative low-quality content from appearing in Discover feeds.
Jun 29, 2026
Google reported that its 2025 enforcement and review efforts blocked **over 1.75 million policy-violating app submissions** from being published on Google Play and resulted in bans of **more than 80,000 developer accounts** tied to harmful behavior. Google attributed these outcomes to expanded *AI-powered, multi-layered* defenses, including developer verification, mandatory pre-review checks, and testing requirements intended to raise the barrier for malicious or non-compliant apps and reduce user harm such as malware, financial fraud, hidden subscriptions, and privacy-invasive behavior. Google also said it prevented **over 255,000 apps** from obtaining excessive access to sensitive user data and that Google Play runs **10,000+ safety checks** as part of its protections, with detection strengthened by integrating newer generative AI models to help reviewers identify evolving malicious patterns. Additional ecosystem integrity measures cited include blocking **160 million** suspicious/inauthentic ratings and identifying large volumes of malicious sideloaded apps via **Play Protect**, which Google said scans hundreds of billions of apps daily and expanded “enhanced fraud protection” coverage broadly across Android devices, blocking large numbers of risky installation attempts.
Jun 29, 2026
**Infoblox researchers** reported that a large-scale scam push-notification operation targeting primarily **Android Chrome** users was partially exposed after the threat actor made a **DNS configuration error** that left domains in a **lame delegation** state (a “**Sitting Ducks**” condition). By legitimately re-claiming an abandoned actor-controlled domain at its DNS provider—without accessing victim devices or the attacker’s servers—the researchers redirected notification and tracking traffic to infrastructure they controlled, gaining a live view of the criminal ecosystem behind the deceptive browser-notification spam. Telemetry collected from victim browsers included rich JSON-style request data (e.g., device and locale details, lure text, and click behavior) and showed sustained, high-volume abuse: users could receive **100–140+ notifications per day** for extended periods, with lures ranging from fake security alerts to gambling and adult content. Reporting indicates the researchers expanded collection from a single domain to **nearly 120 domains**, capturing **tens of millions of records** (including a cited figure of **~57 million logs over two weeks**) and observing global activity across **60+ languages**, with traffic heavily concentrated in **South Asia** (notably Bangladesh, India, Indonesia, and Pakistan).
Jun 29, 2026