Escape key is not a user activation

The Escape key is no longer treated as a user activation.

Browsers prevents calls to abusable APIs (like popup, fullscreen, vibrate etc) unless the user activates the page through direct interactions. Not all interactions trigger user activation. For example, clicking on a link or typing in a textbox does, but swiping fingers on a screen or hovering with the mouse cursor doesn't. Since users never intend to interact with the page through the ESC key, it should not trigger user activation. Most importantly, ESC key activation recently turned out to be the root cause of one abuse vector.

Demo

Documentation

Specification

Public discussion

Status in Chromium

Blink>Input


Enabled by default (tracking bug) in:

  • Chrome for desktop release 76
  • Chrome for Android release 76
  • Android WebView release 76

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • Shipped
  • No public signals
  • No public signals
  • No signals

Owner

Intent to Implement url

Intent to Implement thread

Last updated on 2019-06-04