Chrome Now Blocks 7 Billion Junk Notifications a Day on Android

Key points

• Google says Chrome stopped more than 7 billion unwanted notifications on Android every day during the first quarter of 2026.
• Sites flagged as disruptive are throttled to 1,000 messages a minute, with the rest bounced back as an HTTP 429 error.
• Chrome auto-revokes notification permissions from sites users have ignored or that keep triggering warnings.
• Google is now looking at coordinated networks of sites pushing malicious notifications together, not just individual offenders.
• Users can review what has permission to notify them under Settings > Notifications on Android.

Google has quietly turned Chrome into one of the biggest spam filters on the planet. The company reported blocking more than 7 billion unwanted push notifications on Android every day in the first three months of 2026.

Those pop-up banners that slide in claiming you have a virus, an unpaid parcel fee, or a mystery bank transfer waiting are the target. Criminals use them to push scams, malware (harmful software) and phishing pages (fake login screens built to steal passwords).

This isn't an authentication story in the strict sense. It's closer to authorization gone wrong: a user clicks "Allow" on a notification prompt once, by accident, and a shady site inherits a direct line to their lock screen for months. We covered Chrome's security posture on 31 July, when a single patch cycle closed more bugs than the prior two years combined. The notification abuse problem shows a different edge of the same surface.

How is Chrome deciding what to block?

Google uses what it calls a "Swiss cheese" model: several overlapping checks so that if one misses, another catches the abuse. "Our goal is to ensure that if abuse slips through one layer, another is there to catch it," Google said in its blog post.

Chrome watches actual behaviour. Granted notification permission months ago and never went back? The browser now quietly revokes it. Sites that keep triggering Chrome's suspicious-notification warnings lose their permissions too.

The browser also weighs notification volume, time spent on a site, how often a site nags for permission, and whether users ever click the alerts it sends. Sites judged disruptive get throttled to 1,000 messages a minute. Anything beyond that gets refused with an HTTP 429 response, the standard web code for "too many requests."

What is new this time?

Google is now hunting networks of sites, not just single bad pages. Its systems analyse coordinated service worker activity, the small background scripts websites use to send push notifications, to spot rings of related sites pushing the same scams.

"This enables us to proactively revoke permissions from these persistent bad actors, protecting users from deceptive notifications even when the site content might not seem inherently malicious," Google said in the post, first reported by BleepingComputer.

A page can look perfectly innocent while its notification pipeline funnels victims toward a fake bank login. Chrome now tries to catch the pipeline, not just the page.

Should ordinary users do anything?

Yes, and it takes about a minute. On Android, open Chrome, tap the Settings menu, go to Notifications, and scroll through the sites you've allowed. Revoke anything you don't recognise or no longer use. On desktop, the same list lives under Settings > Privacy and security > Site Settings > Notifications.

If a notification ever tells you your device is infected, your account is locked, or you owe a delivery fee, treat it as a scam. Real banks and real couriers don't warn you through a browser pop-up.

Stronger multi-factor authentication wouldn't have helped here. This is a consent problem, not a credential one. The fix is browsers being less generous with permissions they hand out, and users being pickier about what they click "Allow" on.