Where "Your Device Is Infected" Pop-ups Come From
Browser push notifications are a legitimate technology. Any site can ask for permission to show you notifications even when its tab is closed, thanks to the Notifications API and Push API web standards; background delivery is handled by a service worker, a small script the site registers in your browser on your first visit. News outlets and email services use this honestly, sending headlines and reminders. The technology itself isn't the problem — who gets the permission and how is.
Once you click "Allow" on a permission prompt — often without reading it or noticing which site you're even on — that site can send you notifications indefinitely, until you revoke the permission yourself. On desktop, these notifications arrive as long as the browser process itself is running in the background, even if the specific tab is closed; on Android they arrive through the system notification shade, looking just like a notification from an installed app, because Chrome on mobile hands the display off to the OS. That's exactly why a "notification from a website" can look indistinguishable from a real system warning, even though no infection has actually happened — the site is simply using a channel you once opened.
How Sites Trick You Into Clicking "Allow"
A legitimate site asks for notification permission after you've taken some meaningful action — subscribing to a newsletter, adding an item to your cart. Scam and ad networks do the opposite: they trigger the browser's permission prompt the instant you land on the page, disguising it as a mandatory step the "site needs" to work.
- A fake CAPTCHA that says "Click Allow to prove you're not a robot." A real CAPTCHA never uses the browser's system permission prompt — this is a bait-and-switch on what the button means. A related trick is covered in our piece on the fake CAPTCHA ClickFix scam, though its goal is different: tricking you into pasting a command, not granting a permission.
- "Allow notifications to watch this video or download this file." A classic on pirated streaming and file-sharing sites: the content supposedly won't load without it.
- "Confirm you're over 18." The notification request is disguised as an age gate.
- Redirects from ad networks. Clicking a banner ad or a shortened link lands you on an intermediate page whose only purpose is to get you to click "Allow" before the promised content ever appears.
- A misaligned close button. The visible close (X) on a pop-up is positioned so a careless click lands exactly on "Allow" in the system dialog underneath it.
Why These Notifications Are Dangerous
Once the permission is granted, that channel gets used for whatever makes the ad network money: click traffic to phishing pages, paid subscription traps, or pushing you toward dubious software downloads. One common category is scareware: a notification imitates an antivirus alert about an infection and offers a "cleaner" tool that is itself malware or a useless paid subscription.
The most dangerous notifications lead to fake login pages — for your bank, your email, a popular service. If you type your username and password into one of those, the credentials go straight to the attacker. A related but mechanically different threat is infostealer malware that steals passwords and cookies — that one activates only after a malicious file has already landed on your device; notification spam more often works as the entry point toward that file rather than being malicious code itself.
| Notification text | What it actually is | What to do |
|---|---|---|
| "Your device is infected, run a scan" | Scareware imitating an antivirus alert, meant to sell a useless "cleaner" or install real malware | Don't click. Antivirus software never reports infections through a web push |
| "Update Chrome / Flash Player" | A fake update notice; the actual download is third-party software | Only update your browser from its own "About" menu, never from a notification link |
| "You've won a prize, click to claim" | A classic lure leading to a form asking for payment details or a phone number | Close it, don't click through at all |
| "Suspicious sign-in detected, verify your identity" | A phishing page mimicking your bank or email sign-in | Only check a sign-in alert through a bookmark or by typing the address yourself, never via the notification |
| "You have a new message" / "Your USPS package couldn't be delivered" | Bait leading to a phishing page impersonating a courier or messaging app | Check package status only on the carrier's official site, typed in directly |
How to Turn Off Notifications in Chrome on Desktop
The main fix is the list of allowed sites in your settings. Go to Settings → Privacy and security → Site settings → Notifications. Under "Allowed to send notifications," find the unfamiliar or suspicious address, click the three dots next to it, and choose "Remove" or switch it to "Block." The faster route is to click the icon to the left of the address bar on the offending page itself and select "Notifications → Block."
Chrome can also show notification requests as a quiet icon in the address bar instead of a pop-up — these are called "quiet" requests. Turn them on in the same site settings section: the toggle for "Ask before sending notifications (recommended)" and the related option for sites whose requests tend to be abusive. With this mode on, the intrusive prompt never pops up on its own, which makes an accidental "Allow" click much less likely.
Since October 2025, Chrome on desktop and Android has included a built-in mechanism inside Safety Check: the browser automatically revokes notification permission from sites that send a high volume of notifications with very low user engagement — per Google, fewer than 1% of all notifications sent get any interaction at all. Chrome reports when it revokes a permission this way, the feature can be turned off in settings, and you can manually re-grant permission on the site if a revocation was a mistake. One important detail: this auto-revoke does not apply to installed web apps (PWAs) — that's a separate case covered below.
If notifications persist after cleanup
Sometimes ads keep arriving even after you've removed a site from the permissions list. A common cause is that the page was installed as a web app (PWA): an installed app gets its own separate permission scope that Chrome's general auto-revoke doesn't touch. Check the list via your profile icon or the address chrome://apps and remove any app you don't recognize. The second common cause is a browser extension generating notifications on its own, bypassing the site entirely — open your extensions list and disable anything unfamiliar.
Edge, Firefox, and Safari
Microsoft Edge
The path is nearly identical to Chrome, since both are built on Chromium: Settings → Cookies and site permissions → Notifications. In the list of allowed sites, remove or block the unfamiliar address. The same section has a toggle for "quiet" requests — turn it on so new sites can't pop up a permission prompt uninvited.
Mozilla Firefox
Go to Settings → Privacy & Security → Permissions → Notifications → Settings…. In the window that opens, select the site and change its status to "Block," or remove the entry entirely. The same panel has a checkbox labeled "Block new requests asking to allow notifications" — turn it on if these prompts keep appearing on new sites.
Safari (macOS)
Open Safari → Settings → Websites → Notifications. The list works the same way as in Chrome: find the site you don't recognize and change its permission to "Deny," or remove it from the list.
How to Remove Spam Notifications on Android
From the notification shade
The fastest method is a long press on the spam notification itself in the shade. Android will show the sending site's name (usually routed through Chrome) and a button that jumps straight to that source's settings, where you can turn off notifications immediately, no menu-hunting required.
Through Chrome's settings
Chrome → Settings → Site settings → Notifications — the list works the same way as on desktop: find the site in the allowed list and remove it.
Through system settings
Android Settings → Apps → Chrome → Notifications — inside you'll find a "Sites" category or similar, listing the individual domain permissions granted through Chrome. Samsung Internet and other Chromium-based Android browsers work on the same principle: look for "Site settings" inside the browser app itself.
If ads take over your entire screen and keep appearing even when no browser is open, that's no longer a web notification — it's a separate ad-serving app (adware) that was granted excessive system permissions at install time. That's a different class of problem; for a full breakdown of which app permissions are risky and how to check them, see our guide on dangerous app permissions.
Windows and macOS: Pop-ups in the Corner of Your Screen
On Windows 11, you can temporarily turn off corner pop-ups for a specific browser entirely: go to Settings → System → Notifications, find the browser in the app list, and flip its toggle off. That's a fast way to stop the flood, but it's temporary — the permission itself is still sitting in the browser and can resurface after a restart if you don't remove it at the source.
On macOS, notifications are managed under System Settings → Notifications, where you can likewise disable the browser as an app. In both cases, the OS-level switch is a circuit breaker, not a cure: the root of the problem is still the permission list inside the browser itself, and that's what actually needs cleaning so the problem doesn't come back.
Checklist: What to Do Right Now
- Don't click a suspicious notification — not the body, and not any button inside it, including ones that look like "close" or "dismiss."
- Open your browser's list of allowed sites and remove anything you don't recognize or don't remember allowing.
- Turn on "quiet" requests or a full block on new requests for notifications, so an accidental "Allow" click becomes nearly impossible.
- Leave Chrome's auto-revoke feature on (part of Safety Check) — it quietly cleans up forgotten permissions on its own.
- Check your installed web apps and extensions and remove anything unfamiliar — they don't fall under the general auto-revoke.
- If you already clicked through one of these notifications and entered data, change your password, sign out of all active sessions for that service, and check your linked card for suspicious charges.
- Scan your device with antivirus software if you downloaded anything from a notification link.
- On public networks, use the LiMP VPN extension for Chrome — it encrypts your browser traffic and stops whoever controls an open hotspot from swapping pages or intercepting data in transit. One honest caveat: a VPN does not revoke a notification permission you've already granted — that's only fixed in the site settings covered above. Before clicking any link from a notification, it's also worth running through our guide on how to spot a fake website.
