It boggles my mind why this doesn't require any permission. Every now and then I misclick on some sketchy ads and it's always the loud alert ringtone + alert popup + back navigation hijacking + my phone vibrating non-stop. I've never seen this vibration "feature" used for anything legitimate on the web, ever.