HTTP Permissions-Policy Header Builder

Controls whether the browser groups users into cohort buckets based on browsing history for targeted advertising (Google FLoC).

Threat Mitigation: Disabling prevents third-party ad networks and browser vendors from profiling user browsing patterns without consent.

Controls whether the browser calculates high-level interest topics from a user's recent webpage visits to serve targeted ads.

Threat Mitigation: Disabling blocks Chrome's Topics API from categorizing your visitors into commercial ad segments.

Controls whether cross-site conversion tracking and ad click/view attribution can be reported to ad networks.

Threat Mitigation: Restricts ad platforms from collecting cross-site attribution and impression telemetry.

Controls whether the browser can run in-browser ad auctions using the Protected Audience (FLEDGE) API.

Threat Mitigation: Prevents unauthorized scripts from executing ad bidding algorithms and auction queries locally in the visitor's browser.

Controls whether scripts can add the visitor's browser to interest groups for targeted retargeting advertisements.

Threat Mitigation: Prevents embedded widgets or compromised dependencies from enrolling visitors in remarketing pools.

Controls whether web applications can observe CPU utilization, processor throttling, and thermal states of the device.

Threat Mitigation: Mitigates device fingerprinting vectors that infer hardware specs through CPU load telemetry.

Controls access to video input devices including webcams and external cameras.

Threat Mitigation: Stops rogue third-party advertising or analytics scripts from secretly requesting or accessing video feeds.

Controls access to audio input devices such as built-in and external microphones.

Threat Mitigation: Blocks unauthorized audio listening, acoustic eavesdropping, and covert background recording.

Controls access to the Geolocation API for obtaining precise latitude, longitude, and altitude coordinates.

Threat Mitigation: Prevents unauthorized location tracking and geospatial profiling of users across embedded elements.

Controls access to the Screen Capture API (getDisplayMedia) for capturing the visitor's screen or window contents.

Threat Mitigation: Blocks unauthorized desktop recording and screen scraping from embedded frames or injected scripts.

Controls access to motion sensors measuring physical device acceleration along 3-dimensional axes.

Threat Mitigation: Prevents motion-based keystroke sniffing, side-channel eavesdropping, and battery drain.

Controls access to rotational velocity and orientation sensors measuring physical device tilt.

Threat Mitigation: Mitigates behavioral biometric tracking and motion sensor acoustic eavesdropping attacks.

Controls access to magnetic field sensors measuring geomagnetic field orientation.

Threat Mitigation: Prevents indoor positioning inference and hardware fingerprinting.

Controls access to ambient light sensors measuring environmental illuminance levels in lux.

Threat Mitigation: Blocks cross-device ultrasonic beaconing and light-based display reflection side channels.

Controls access to connected MIDI musical instruments, synthesizer controllers, and sysex commands.

Threat Mitigation: Restricts hardware communication with peripheral synthesizer devices and firmware tampering.

Controls access to virtual, augmented, and mixed reality spatial tracking hardware and head-mounted displays.

Threat Mitigation: Prevents unauthorized room mapping, headset sensor data collection, and biometric eye tracking.

Controls access to the Payment Request API for initiating browser-mediated checkout flows (Apple Pay, Google Pay).

Threat Mitigation: Stops unvetted third-party iframes from spawning fraudulent payment dialogues or skimming credit cards.

Controls access to universal serial bus (USB) connected hardware peripherals directly from JavaScript.

Threat Mitigation: Blocks arbitrary low-level communication with plugged-in flash drives, hardware tokens, or debugging cables.

Controls access to hardware serial ports (COM ports, Arduinos, microcontrollers, barcode scanners).

Threat Mitigation: Prevents malicious scripts from interacting directly with raw serial hardware interfaces.

Controls access to Bluetooth Low Energy (BLE) peripheral devices and wireless sensors.

Threat Mitigation: Stops unauthorized pairing and data transmission with nearby wireless medical, fitness, or IoT devices.

Controls access to PC/SC smart card readers and physical cryptographic chip cards.

Threat Mitigation: Blocks access to government identity smart cards, corporate badges, and bank card chips.

Controls whether HTML5 `<video>` and `<audio>` elements can automatically start playback with audio.

Threat Mitigation: Eliminates intrusive auto-playing video ads, acoustic annoyance, and unexpected mobile bandwidth consumption.

Controls whether JavaScript can execute synchronous (blocking) XMLHttpRequest network calls.

Threat Mitigation: Disabling prevents poorly written legacy third-party scripts from freezing the main UI thread and degrading INP/FID.

Controls whether scripts can set `document.domain` to relax the same-origin policy between subdomains.

Threat Mitigation: Prevents subdomain-takeover vulnerabilities and cross-subdomain DOM security boundary relaxation.