The workaround for now is to have the service worker fetch the payload from an API endpoint that the sender implements themselves.
Chrome is literally botnet