Remove navigator.vibrate without user gesture

Calls to navigator.vibrate will immediately return 'false' if user hasn't tapped on the frame or any embedded frame yet. The Vibrate API is being abused by malicious sites. This extends what we do for cross-origin iframes to all frames including top-level page. See


Status in Chromium

Enabled by default (launch bug) in:

  • Chrome for desktop release 60
  • Opera release 47
  • Opera for Android release 47

Consensus & Standardization

  • No public signals
  • No public signals
  • No public signals
  • No signals


Last updated on 2017-05-16