Chrome 76: ESC-key use no longer seen as user action to block spam

[harlan4096]

From Chrome 76 on, Google won't allow sites access to certain APIs anymore based on a user's use of the ESC-key on such sites to fight abuse.

Most modern browsers prevent access to certain APIs open the websites based on user interactions with webpages. Access to certain APIs such as those that allow popups or screen changes, is blocked until the user interacts with the page in question.

Downloads are a basic example: they should be allowed if the user interacts with download links or buttons, but it is not a good idea to allow them if the user did not interact with the webpage in any form prior to the action.

Google introduced a new protective feature in Chrome recently that blocks automatic downloads in ad frames.

Another example is audio playback on sites. While you expect that to happen when you click on a video's play button, you may not expect sites to play audio without you interacting with that site first (and even then, you sometimes may not want sites to play audio, but that is another issue altogether).

Not every user interaction may indicate that it is okay to go ahead with certain activity on a webpage. A click or tap certainly falls into the user interaction category, but actions such as pressing the ESC-key on the computer keyboard, opening the Developer Tools, or hovering the mouse cursor over an element don't.

Google Chrome handles the ESC-key currently as active user interaction and that means that sites gain access to certain APIs.

The Esc-key may be used to stop the loading of a site and Google believes that this should not be counted as page interaction, however, and going forward, ESC won't be counted as such anymore.

Continue Reading