Web push notifications are browser-delivered alerts that a website can send after a user grants notification permission. They can appear even when the site is not open, which makes them useful for legitimate reminders, but also attractive for abuse.
In cyber security, the risk is social engineering. Attackers may use push notifications to mimic browser warnings, payment requests, password alerts, or fake support messages, pushing phishing links and malware lures outside the normal page context. Defenders treat notification permission as a trust boundary: browsers can limit abusive sites, revoke permissions, and combine reputation signals such as Safe Browsing with permission controls. For users, regularly reviewing notification access helps reduce unwanted or malicious alerts.