I'm surprised to learn that a web site doesn't need to ask for your permission to access the Vibrate API. I think there must be a warning screen with the list of permissions the web site wants, like the ones we're getting when installing apps from app stores but with a twist so you can disable individual permissions for a web site.
I was replying to the question about getting a list of permissions a page uses/wants.
Neither Vibrate nor WebAudio require permissions from the webpage. Like basic JavaScript they always run. They're not security/privacy risks per se, just something that, like so many other things, could be used to support a phishing attack.
Firefox for Android developer here, you can long-tap on the location bar while on the page and select 'Edit Site Settings'. Is that what you're looking for?
That is only used if the API requires user confirmation. So things like geolocation, camera, and microphone access will be shown. Adding the feature from desktop should be a bug already. If not then we should file one.
