A malicious webpage could use reach tel: or facetime: URLs without Chrome applying its normal user-interaction.