Since HTML pages cannot open up by themselves, and user can navigate away, the risk is lower compared to a native app which can do far more damage. Never the less, permission mechanism should have been enabled.
What about ads? The ones that now e.g. pretend to be Skype pop-ups.
HTML Popups have always been a problem and with re targeting the Ads are a menace. And some clever spoofing is definitely possible. A proper ad/popup blocker for native browsers would help.
I sometimes wonder why AdBlock doesn't silently simulate click on all ads in the background. This way you not only protect users from ad bloat, you also make an incentive for people to stop doing website ads.