Whether delivering malicious content through phishing attacks, fraudulent payment requests or links to malware, notification abuse is a security issue that’s hard to ignore. More so when this threat comes by way of push notifications, which are designed to engage directly with the user in real time. Google hasn’t been ignoring this abuse, and a new blog post has detailed how it has been on a multi-year journey to combat the problem, resulting in more than 7 billion Chrome push notifications being blocked every day across the first three months of 2026. The key to this success has been the deployment of the Swiss Cheese security model, which has allowed Google’s security teams to “halt abuse at the source, preventing deceptive content from reaching users while maintaining a healthy balance between utility and security.” But what is the Swiss Cheese model and how is it helping prevent this kind of notification abuse?

How Has Google Deployed Swiss Cheese Against Notification Abuse?

Google is a company that really does take your security seriously, and the work that goes on behind the scenes to make its ecosystem a safer place for all is often overlooked. This includes small tweaks such as adding warnings to Gmail to prevent potentially costly email errors, Android AI voice scam alerts and the deployment of more regular Chrome security updates .

Now, in an August 11 posting to the Google security blog , Hannah Buonomo from the Chrome security team, Jonathan Li from safe browsing and Nidhi Davawala from Firebase cloud messaging, have confirmed how it is using a combination of user interactions, abuse network detection, server-side throttling and more to combat the problem of potentially dangerous Chrome push notifications. The defense-in-depth approach used by Google is known colloquially as the Swiss Cheese model .

This does actually make sense when you think about it, or rather when you visualize slices of Swiss cheese layered side-by-side. The randomly located holes, all of different sizes, reduce the risk of what can pass through each slice, as the chances of them lining up perfectly decrease with every slice of cheese added. This approach has, Google said, achieved a reduction in Chrome push notifications on Android in excess of 7 billion a day in Q1 of 2026, making billions of users more secure as a result thanks to the “overlapping protections” that cover the entire notification lifecycle. “Our goal is to ensure that if abuse slips through one layer, another is there to catch it,” Google said. These layered protections include:

  • The automatic revoking of notification permissions for sites with which the user hasn’t engaged recently, as well as those that have repeatedly been sent suspicious notification warnings.
  • Message rate limits for the Push API to combat high-volume notification abuse, limiting the impact of disruptive traffic while providing a safety valve for legitimate sites as they respond and adjust their usage patterns.
  • Changes to the notifications permission model that prioritizes user agency, making it harder for abusive actors to acquire and retain permissions

“By unifying these diverse initiatives into a single, cohesive strategy,” Google said in the posting, “we have forged a significantly more resilient Chrome experience.” The good news is that this has been done while retaining user control, as all automatically revoked permissions can be reviewed using the Android Safety Hub. And, of course, you can still control your web notifications in Chrome by opening chrome://settings/content/ on the desktop or Settings|Notifications on Android.