Intervention for programmatic focus without user activation

[Ehsan Karamad]

Hello all,

Backstory:

Programmatic focus without user gesture is a problem in current ads. There is internal bugs filed for it and there is also public interest for a policy

that controls it.

The policy is not yet set in stone, but the main goal it accomplished is that, when this policy is disabled for a document, then the document cannot

acquire focus in any of the forms:

1. 'autofocus'
2. element.focus()
3. window.focus()
4. constraint validation API (when submitting a form leads to focusing a required input field).

Unless it has recently received a user gesture.

Why Intervention:

The fix for programmatic focus is highly desired for the current M75; which makes it too late to go through a proper launch process for a new feautre

policy/sandbox API. Perhaps intervention is the better option short-term and we target M76-77 for the  feature policy.

Intervention:

Block focus of all mentioned types above if the document of the focus target:

1. Is sandboxed
2. Is possibly and ad
3. Has not received user gesture

CL in progress for the feature policy that disables focus: https://crrev.com/c/1586103

Best,

Ehsan 

[Ehsan Karamad]

Actually, I think we should even scratch the second requirement for the content being an "ad" since the current focus behavior for sandbox frames seems

problematic regardless. So the suggestion would be to disable programmatic focus in sandbox frames that do not have user gesture.