Gamepad API uses the "gamepad user gesture" as a signal that the user consents to exposing gamepad information. This makes it possible to unintentionally expose gamepad information when interacting with gamepads on another site.

The spec should be amended to require that the window is focused when the gesture is received so that access is only granted for the focused tab.