The system notifications can come from different sources. A "You've got mail" notification would be generated by the mail client, a "You've got virus" notification would be generated by the anti-virus software. But browser can now access the system notifications through #Javascript, so a webmail page can also send a "You've got mail" notification. And a malicious site can send "You've got virus, click to clean", which might actually launch the malware. I found the Mozilla specification at https://developer.mozilla.org/en-US/docs/Web/API/notification