Additional browser APIs restricted

Beyond camera, microphone, and geolocation, browser APIs like payment, usb, display-capture, accelerometer, gyroscope, and magnetometer give embedded scripts access to hardware interfaces, screen capture, and payment flows. A compromised analytics script with access to display-capture can screenshot users' screens; usb access enables attacks against physical devices; payment access can initiate payment dialogs. CWE-693 applies to each unblocked API. OWASP A05 identifies unnecessary API surface as a security misconfiguration — the principle of least privilege applies to browser API grants just as it does to database permissions.

Extend your Permissions-Policy header to restrict all APIs your application does not use. The full recommended restrictive policy:

headers: [{
  key: 'Permissions-Policy',
  value: [
    'camera=()',
    'microphone=()',
    'geolocation=()',
    'payment=()',
    'usb=()',
    'accelerometer=()',
    'gyroscope=()',
    'magnetometer=()',
    'display-capture=()'
  ].join(', ')
}]

Only remove an API from the restriction list if your application actively calls it. Check your codebase with grep -r 'navigator\.' src/ to inventory which browser APIs you actually use.