How much of your location does a website get?

1. Already known — before any permission prompt

A website receives these the instant the page loads. No dialog, no tap.

2. Exact location — one tap, one reflex

Tap below and accept the browser prompt. Note how little thought it takes.

3. Where the prompt gets bypassed

Not on this page. Here's where it genuinely happens in the wild.

• In-app WebViews. When an app shows you a web page inside itself (login flows, offers, support chat, ads), the app's code decides whether to show you a permission prompt. A callback named onGeolocationPermissionsShowPrompt can be implemented to return true automatically — the page gets your location with zero UI. You trusted the brand, not the SDK inside it.
• Trusted Web Activities (Android). A logic flaw promoted an app's approximate-only permission to precise for websites opened in a Chrome tab. You tapped "Approximate"; the site got GPS.
• Coarse-permission leak (CVE-2026-79075). Chrome was supposed to blur a coarse-only grant to ~2 km. When the OS returned a fix tighter than 2000 m, precise coordinates passed straight through to the site.
• Race conditions (CVE-2026-11145, CVE-2026-79046). Concurrent requests during a permission check could let a cross-origin page win the race and read location data it never had consent for.
• Local override (CVE-2024-49720). A logic error in Android's Permissions.java could flip a location permission's state with no user interaction at all.

All of the above are patched. The pattern is what matters: the prompt is a UI convention, not a security boundary. Any code path that can answer the prompt programmatically — an app, an SDK, a browser bug — is a path around your consent.

4. What this means for us

• Don't collect precise location unless the product genuinely needs it. Request approximate where city-level is enough, and verify the OS grant level matches what your code assumes.
• Audit third-party SDKs for WebView configuration. An SDK that embeds web content can grant geolocation silently. Require an inventory of every WebView and its onGeolocationPermissionsShowPrompt implementation.
• Never let a WebView auto-grant permissions. Proxy the prompt to the user, or deny and degrade gracefully.
• Keep browser and OS baselines patched and monitor mobile browser CVEs — several of these lived for months.
• Log consent events with timestamp, scope (precise vs. approximate) and origin, so you can prove what a user actually agreed to.