Since iOS 27.0, domain-bound SMS one-time codes are no longer offered above the keyboard in our app, where the code is entered on a web page in a WKWebView, although the app is associated with the domain through webcredentials. The same SMS is offered in Safari on the same device, and it is offered in our app on iOS 26.6 and iOS 18. SMS format (last line per the domain-bound code format): Your verification code is: 123456 @app.example.com #123456Setup Several builds of the same app with different bundle IDs (App Store, internal, development), all under one team Entitlement com.apple.developer.associated-domains: webcredentials:app.example.com (plus two more environments of the same domain) AASA at https://app.example.com/.well-known/apple-app-site-association: 200, application/json, no redirect, same content on app-site-association.cdn-apple.com: {"webcredentials":{"apps":["TEAMID.com.example.app","TEAMID.com.example.app.internal","TEAMID.com.example.app.dev"]}} The code field is an <input type="tel" autocomplete="one-time-code"> in a WKWebView showing a page on that domain. We also tested a native field with the one-time-code content type (the app is built with Flutter; the field is a Flutter TextField with the one-time-code autofill hint). Steps Open the verification page in the app and focus the code field. Receive the SMS above. Expected: the code is offered in the QuickType bar, as it is in Safari on the same domain and as it is in our app on iOS 26.6 and iOS 18. Actual: nothing is offered. The keyboard log: kbd Received verification code from Messages kbd One Time Code field has been entered. kbd Retrieving Current One-Time Codes for App kbd Current verification code is domain-bound to <mask.hash: '…'>. kbd Domain-bound verification code is NOT valid for app <mask.hash: 'X'>. E kbd Could not fetch application record for application identifier: <mask.hash: 'X'>. kbd Returning 0 available one-time codesWhat we checked swcd downloads the AASA for all domains without errors after a reinstall. The installed app's entitlements (read from the device) contain the expected application-identifier and associated domains; the profile is validated. The failure is the same in the WKWebView field and in a native one-time-code field, in the App Store build, a distribution-signed internal build and a development build, and in an older app version that used to work. The masked application identifier in the log (X above) is the same for two builds with different bundle IDs, so the lookup does not seem to use the app's bundle ID. All our builds share CFBundleExecutable = Runner (the Flutter default) and the same CFBundleName. The same app build and the same SMS work on iOS 26.6 and iOS 18.x, so the change happened between iOS 26.6 and 27.0. An SMS without the @domain #code line is offered in the app on iOS 27 (Returning 1 available one-time code), although Could not fetch application record is still logged. Questions Is this a known iOS 27 regression, or is there a new requirement for apps to receive domain-bound codes? What application identifier does the keyboard use for this lookup, and can anything in the app's configuration (for example the executable name) affect it? Device: iPhone 17 Pro Max, iOS 27.0

Safari continues to display a "Fraudulent Website Warning" for openvan.camp despite the domain being clean across all major security databases for over a week. Chrome, Firefox, and all other browsers open the site without any warnings. Domain: openvan.camp Warning appeared: March 18, 2026 Warning type: Fraudulent Website Warning (red screen) Current security database status: Google Safe Browsing: ✅ Clean (transparencyreport.google.com) Google Search Console: ✅ No security issues Spamhaus DBL: ✅ Removed from blocklist Fortinet FortiGuard: ✅ Category "Travel" VirusTotal: ✅ 0/65 vendors URLVoid: ✅ 0/35 engines Steps taken: Removed the third-party ad network (Adsterra) that caused the original flag — March 18, 2026 Migrated hosting to Scaleway (AS12876, France), IP: 151.115.84.228 Configured SPF, DKIM, DMARC records Created functional abuse@ and postmaster@ role accounts Submitted review via websitereview.apple.com — no response after 5 days What we believe is happening: Apple's Safe Browsing database appears to have an independent entry for this domain that has not been updated despite all underlying security databases clearing the flag. Safari's warning persists even after deleting ~/Library/Safari/SafeBrowsing/ cache and re-downloading the database — which confirms this is not a local cache issue. Steps to reproduce: Open Safari on macOS or iOS Navigate to https://openvan.camp/ Safari displays "Fraudulent Website Warning" Open the same URL in Chrome — no warning Expected behavior: No warning should be shown. The domain is legitimate, clean, and verified. Has anyone experienced a similar issue? Is there any additional channel to escalate beyond websitereview.apple.com?

When I login to an account on a subdomain of a main domain, I want to be able to store a separate password for the same login id on the main domain account. This doesn't seem possible in the current Safari implementation.eg: domain.com is the main domain and is the general information site.my.domain.com is the subdomain that hosts the customer support.I want different passwords on each for the same login ID... Can't I do this?--marcel

Environment App built with Xcode 26.3 (iOS 26 SDK) Deployment Target: iOS 16+ Issue occurs only on devices upgraded to iOS 27. Works perfectly on iOS 26.x. Problem description: After end‑user upgrades their iPhone to iOS 27, a persistent stale frosted‑glass / blur rendering effect appears at the top area of screens. This symptom occurs both on native UITableView and inside WKWebView. No blur‑related code (UIVisualEffectView / backdrop‑filter) is added by our application. Layout frames, insets and contentOffset are all correct. Reproduction hints: The issue can be triggered after presenting then dismissing a WKWebView which loads H5 with overlay popup. Rendering state seems to leak to the whole app process. The leftover blur remains until push/pop the view controller. Is this an iOS 27 system bug, or do we need special adaptation for existing apps built with older Xcode 26.3 SDK? What is the proper workaround for apps compiled with Xcode26.3, since liquidGlassEffectEnabled is only available in iOS27 SDK and cannot be accessed in our current build environment.

For a UIKit app embedding a WKWebView across the inner display, what is the recommended way to keep web content and interactive controls clear of the fold’s division reserved region? Are these regions exposed to web content through public CSS or JavaScript APIs, or should the UIKit host query them and communicate the geometry to the page? How should this work alongside CSS safe-area insets and the web view’s scroll-view inset adjustment, so that native and web layouts don’t apply the same spacing twice? A small UIKit + WKWebView example would be very helpful.

I filed FB24577577 about the Dock disappearing after WKWebView element fullscreen in a macOS accessory app. I retested the original minimal reproduction on macOS 27.0 (26A428), and the symptom still occurs on the built-in display alone. Is this combination of public AppKit/WebKit APIs supported? Is there an application-side workaround that preserves both an accessory activation policy and a window that joins all Spaces? Reproduction The app uses: NSApplication.ActivationPolicy.accessory (no Dock tile). NSWindow.CollectionBehavior.canJoinAllSpaces on the window hosting the WKWebView. WKPreferences.isElementFullscreenEnabled = true. Element.requestFullscreen() to enter fullscreen. A normal titled window at normal window level and a local HTML page containing a single div are sufficient. No external website, video, networking, custom window subclass, or private API is involved. The key AppKit/WebKit configuration is: NSApplication.shared.setActivationPolicy(.accessory) window.collectionBehavior = [.canJoinAllSpaces] configuration.preferences.isElementFullscreenEnabled = true Load a local HTML page with one clickable div whose click handler calls requestFullscreen() on that element. Keep the application running and retain the window/web view. With Dock auto-hide disabled, enter element fullscreen, then exit and inspect the Dock. The macOS 27 retest entered by evaluating a click on the div through WKWebView.evaluateJavaScript, confirmed document.fullscreenElement was non-null, and exited with document.exitFullscreen(). The original macOS 26 testing also reproduced with Escape. Expected: the Dock resumes its normal always-visible behavior after fullscreen ends. Actual: the right-side Dock disappears despite auto-hide remaining disabled. macOS 27 retest (September 16, 2026) macOS 27.0, build 26A428. NSScreen enumerated exactly one built-in display at the start of this run. Dock on the right, auto-hide disabled throughout. Fullscreen entry was confirmed, and document.fullscreenElement was null after exit. Both NSApp.presentationOptions and NSApp.currentSystemPresentationOptions returned to 0. The Dock was visually absent after exit. Its on-screen window count changed from 1 to 0 and was still 0 six seconds later. Window counts were supporting evidence, not the sole visual criterion. An external display was reconnected later, so this retest does not establish indefinite persistence or that restarting Dock is the only recovery route. Earlier comparisons and product impact The original report was reproduced on macOS 26.6.2 (25G83). In those earlier comparisons, removing canJoinAllSpaces avoided the symptom; using native AppKit window fullscreen instead of WebKit element fullscreen also avoided it. These controls were not rerun on macOS 27. Restarting Dock restored it in the earlier tests. This affects Nifro, a desktop-wallpaper app using WKWebView. The current app keeps element fullscreen disabled. Joining all Spaces and having no Dock tile are useful parts of its wallpaper behavior, so changing either has a product cost. Could an AppKit/WebKit engineer advise whether this is an unsupported configuration or a system issue tracked by FB24577577, and whether a supported public-API workaround exists? I can provide further targeted diagnostics if needed.

I'm encountering an issue with front camera video recordings via browser (Safari/Chrome) on devices running iOS/iPadOS 18 and above: On iPad, the recorded video appears upside down. On iPhone, the recorded video is rotated 90 degrees. The rear camera functions correctly without orientation issues. This problem seems specific to browser-based recordings, as the native Camera app records videos with the correct orientation. Has anyone else experienced this behavior? Is there a known workaround or fix? The preview while recording is fine, the recorded video is oriented incorrectly.

Does anyone have any advice on working a way around this, or through this? My app is wrapped and WKWebView displays HTML/CSS/JAVA and StoreKit is iOS framework. I used choicely up wrap it because i don't own a mac. The only part i can't control is this. I'll likely have to wrap it myself, rent a cloud Mac and submit directly to ensure everything is attached to the binary. I can't control that from choicely. any other ideas!? I’ve been over a month trying to get this going. It’s live but with no way to transact the subscribers I’m already getting. HELP PLEASE!

Two unrelated, legitimate websites I own are both shown as "Deceptive Website — Apple has identified this website as fraudulent" in Safari (iOS + macOS), and even inside my installed PWA on iOS. This is a false positive and I can't find a working way to get Apple to remove it. Why I'm confident it's a false positive: Google Safe Browsing site status: clean Google Search Console (verified owner) > Security Issues: none Yandex Webmaster > Security: no violations VirusTotal: 0/92 detections Chrome, Firefox, Yandex Browser: NO warning on any platform Only Safari shows it, wording is "Apple has identified..." — i.e. Apple's own list, not the Google Safe Browsing feed The sites are genuinely benign: no brand impersonation, no third-party credential harvesting, no malware, no drive-by downloads. The interesting part — it's TWO unrelated sites: Site A: a small web app (SaaS with a login form) Site B: my personal developer portfolio — static, no login at all They share almost nothing: different codebase, different design, different hosting (Site A is behind Cloudflare with a Google Trust Services edge cert; Site B is a plain nginx box with a Let's Encrypt cert), different TLS issuers, different stacks. The ONLY common denominator is me as the owner/registrant (same person, same contact email, same registrar account). This makes me think the domains were clustered by registrant/owner rather than by anything on the sites themselves. The two-sites fact also rules out the usual scapegoats: it isn't Cloudflare (Site B isn't even on Cloudflare and is flagged too), nor the cert issuer, host, or stack, since those differ. What I've already done: Clicked "Report an error" on the Safari warning page Submitted the Google Safe Browsing incorrect-warning report Filed a tracked report in Feedback Assistant (FB number, status Open) Hardened both sites anyway: CSP + security headers, SPF/DKIM/DMARC, and real trust pages (About with owner identity + contact, Privacy Policy, Terms, linked from homepage and login page) It's been about a week with no response. My questions: When Google Safe Browsing is clean but Safari still flags, what feeds Apple's OWN fraudulent-site list? Is registrant/owner clustering a real mechanism here? Which removal channel actually works in practice? Realistic timeline for a false-positive removal? If one domain is cleared, does that clear the owner-level association for the other, or do I appeal each separately? Is there anything that re-triggers it? (Considering a domain migration as a last resort and want to avoid a new domain getting re-flagged.) Any first-hand experience is appreciated — the process is completely opaque.