Chrome Now Blocks 7 Billion Junk Notifications a Day on Android

Key points

• Google says Chrome stopped more than 7 billion unwanted notifications on Android every day during the first quarter of 2026.
• Sites flagged as disruptive are throttled to 1,000 messages a minute, with the rest bounced back as an HTTP 429 error.
• Chrome auto-revokes notification permissions from sites users have ignored or that keep triggering warnings.
• Google is now looking at coordinated networks of sites pushing malicious notifications together, not just individual offenders.
• Users can review what has permission to notify them under Settings > Notifications on Android.

Google has quietly turned Chrome into one of the biggest spam filters on the planet. The company says its browser blocked more than 7 billion unwanted push notifications on Android every day in the first three months of 2026.

The target is a specific kind of nuisance: the pop-up banners that slide in from the top of your phone claiming you have a virus, an unpaid parcel fee, or a mystery bank transfer waiting. Criminals use them to push scams, malware (harmful software), and phishing pages (fake login screens built to steal passwords).

This is not an authentication story in the strict sense. It is closer to authorization gone wrong: users click "Allow" on a notification prompt once, often by accident, and a shady site inherits a direct line to their lock screen for months.

How is Chrome deciding what to block?

Google is using what it calls a "Swiss cheese" model, several overlapping checks so that if one misses, another catches the abuse. No single filter has to be perfect.

Chrome watches how you actually behave on a site. If you granted notification permission months ago and never went back, the browser now quietly revokes it. Sites that keep triggering Chrome's "suspicious notification" warnings lose their permissions too.

The browser also weighs notification volume, how long you spend on the site, how often it nags you for permission, and whether you ever click the alerts it sends. Sites judged disruptive get throttled to 1,000 messages a minute. Anything beyond that gets refused with an HTTP 429 response, the standard web code for "too many requests."

What is new this time?

Google is now hunting networks of sites, not just single bad pages. Its systems look at coordinated service worker activity, the small background scripts websites use to send push notifications, to spot rings of related sites pushing the same scams.

"This enables us to proactively revoke permissions from these persistent bad actors, protecting users from deceptive notifications even when the site content might not seem inherently malicious," Google said in the blog post first reported by BleepingComputer.

Translation: a page can look perfectly innocent while its notification pipeline is being used to funnel victims toward a fake bank login. Chrome now tries to catch the pipeline, not just the page.

Should ordinary users do anything?

Yes, and it takes about a minute. On Android, open Chrome, tap Settings, then Notifications, and scroll through the list of sites you have allowed. Revoke anything you do not recognise or no longer use. On a desktop, the same list lives under Settings > Privacy and security > Site Settings > Notifications.

If a notification ever tells you your device is infected, your account is locked, or you owe a delivery fee, treat it as a scam. Real banks, real couriers and real antivirus tools do not warn you through a browser pop-up.

Would stronger multi-factor authentication have helped here? Honestly, no. This is a consent problem, not a credential one. The fix is browsers being less generous with permissions they hand out, and users being pickier about what they click "Allow" on in the first place.