On iOS 26.5, occasionally when WKWebView calls loadRequest to load a URL containing a fragment, it sends the complete URL to the backend.

Hello Apple engineers and fellow developers, Over the past few weeks I have noticed multiple reports from different developers whose legitimate websites have been classified by Safari as “Fraudulent Website Warning”, despite passing every major public security and reputation check. My websites appear to be affected by the same issue. Domains https://skvoz.net https://skvoz.org Both domains were registered on July 15, 2026. The Fraudulent Website Warning first appeared on July 22, 2026, only one week after registration. Both websites are legitimate services operated by our team. Neither website impersonates another brand, attempts to collect Apple IDs, banking credentials, passwords, or any other sensitive information through deceptive means. Extensive verification performed After the warning appeared, we performed a comprehensive technical and security review. Website security ✅ No malware detected ✅ No phishing content ✅ No unauthorized redirects ✅ No suspicious JavaScript ✅ No mixed-content issues ✅ HTTPS configured correctly ✅ Valid TLS certificates Infrastructure DNS configuration verified SSL certificate chain verified using OpenSSL Server responds correctly over HTTP/2 IPv4 and IPv6 connectivity verified Origin server behaves correctly Cloudflare configuration was thoroughly tested during troubleshooting and ultimately removed from the production setup to eliminate it as a possible cause Reputation checks We verified both domains and the hosting IP address using multiple public reputation services. Results were consistently clean. This included services such as: Google Safe Browsing Google Search Console VirusTotal URLVoid IP reputation databases None of them currently report malware, phishing activity, or any other security issues. Apple-specific actions We have already: submitted a Website Review request; contacted Apple Security via reportphishing @apple.com requesting a manual review. At the time of writing, the warning is still present. One unusual observation One particularly unusual observation is that both of our domains (skvoz.net and skvoz.org) received the warning independently. These are separate domains serving different purposes, yet both appear to have been classified in the same way despite passing the same technical and reputation checks. This made me wonder whether Apple’s reputation system may evaluate related domains or shared infrastructure together. I understand the internal implementation is not public, but I wanted to mention this observation in case it is useful during investigation. Similar reports While investigating this issue, I found several recent reports from other developers describing almost identical behavior. The common pattern is remarkably consistent: Safari displays Fraudulent Website Warning Chrome, Firefox and Edge open the website normally Google Safe Browsing reports the domain as safe VirusTotal reports no malware Google Search Console reports no security issues valid HTTPS certificates relatively new domains no explanation regarding what triggered the warning This suggests the issue may not be isolated to a single website. Questions I would greatly appreciate any guidance from Apple engineers. Does Safari rely solely on Google Safe Browsing, or does Apple maintain an independent reputation database for Fraudulent Website Warning? If Apple maintains its own reputation system, are there any documented technical signals developers should verify? For example: redirects third-party scripts TLS configuration domain age hosting reputation infrastructure characteristics phishing heuristics machine-learning based classification Is there any recommended diagnostic process beyond Website Review? Approximately how long does a manual review usually take? Why I am posting This post is not only about my own websites. Over the past few months I have noticed an increasing number of developers reporting what appear to be false positive Fraudulent Website Warnings affecting legitimate websites. If there have been recent changes to Safari’s reputation or anti-phishing systems, it would be extremely helpful for developers to better understand what technical criteria should be reviewed before requesting reconsideration. Even if the exact detection logic cannot be disclosed, any general guidance on common causes of false positives would help developers resolve issues much more efficiently. Thank you very much for your time.

webkitEnterFullScreen API is supported on iOS for video element, but not for a div element. Also as a fullscreen demo website shown, Safari on macOS supports div element but not on iOS. Is there any plan to add the support in iOS? If not is there any way to fullscreen a div element or make it run as fullscreen on Safari iOS?

Hello, I have recently discovered that our company website, https://www.cgs.com, displays the message "Website Not Allowed, cgs.com is a restricted website." when accessed via iOS Safari. After investigation, I found that this occurs when the Limit Adult Websites option is enabled under Settings → Screen Time → Content & Privacy Restrictions → App Store,Media, Web, & Games → Web Content. I believe this restriction has been applied incorrectly to our website, and I would like to formally request that https://www.cgs.com be removed from this restricted list. Please let me know if any supporting materials or documentation are required from our side. Best regards

It appears that Reality Composer Pro 3 does not export a full USDZ file with textures, animations, etc. The best I can tell is that it exports only the mesh (as suggested by the menu name). I have been using Reality Composer Pro 2 to create USDZ files to use as website environments. Will we no longer be able to create website environments with RCP 3? Will there be any way to download and use the old RCP 2 after upgrading to macOS 27 and Xcode 27?

Tested iPhone 16 Pro Max running DB2 Since using iOS 27 Developer Beta, Progressive Web Apps (PWAs) and applications using WKWebView that route live streaming audio (such as Icecast/SHOUTcast streams) through the Web Audio API (AudioContext / MediaElementAudioSourceNode for canvas visualizers) experience silent playback freezes during track changes. The JavaScript context remains active, and the HTMLMediaElement reports no errors or pauses, but the low-level system audio daemon (audiod) disconnects. The logs indicate a state desynchronization in MediaToolbox triggered by inline metadata frame updates, coupled with massive sandbox violations. Steps to reproduce: Run a PWA or WKWebView on iOS 27 Developer Beta that loads a live audio stream using an tag. Route the media element into the Web Audio API (e.g., audioContext.createMediaElementSource(audioElement)). Play the stream and lock the screen or let it run in the foreground. Wait for a track transition to occur on the live stream server (which pushes an inline ICY metadata update). Observed Result: Audio instantly goes silent at the track boundary. JavaScript rendering loops remain active, but the stream is dead. List of important errors: MediaToolbox parsing failure: <<<< FigStreamPlayer >>>> fpfs_CacheRenderChain: Caching unexpected mediatype metadata Reasoning: When the stream updates its inline metadata, MediaToolbox (FigStreamPlayer) fails to handle the frame descriptor correctly, halting the stream decoder render chain. Audio engine state desynchronization: <<<< FigStreamPlayer >>>> fpfs_SetRateOnTrack: [...] setting rate on track before it has reached playing state - 4 instead Reasoning: WebKit attempts to keep playing or setting the playback rate, but MediaToolbox fails because the underlying decoder track is stuck in an uninitialized/stalled state (4). System Audio Daemon Disconnection: Subsystem: com.apple.audioanalytics | Process: audiod Reporter disconnected. ( function=sendMessage, reporterID=... ) Reasoning: Because the rendering stream stalled, the system audio daemon (audiod) forcibly severs the audio session connection to the browser container. Massive Sandbox Log Flooding (WebKit.WebContent): Sandbox: com.apple.WebKit.WebContent(2719) deny(1) syscall-unix 179 Reasoning: WebKit's WebAudio thread tries to log trace markers to XNU's kdebug_trace64 (syscall 179) but is blocked by the WebContent sandbox profile, resulting in a loop of thousands of denials that clog the thread. What needs to be fixed: MediaToolbox (FigStreamPlayer): Fix the regression where incoming live stream metadata frames stall the render chain when connected to a Web Audio node. WebKit Sandbox Profiles: Update the iOS WebContent, Network, and GPU sandbox rules to allow necessary tracing/diagnostic calls (syscall-unix 179 and mach-lookup com.apple.diagnosticd) in developer beta builds to prevent thread-blocking loops.

Canvas Previews (targeting macOS) in both Xcode 16.4 & Xcode 26 fail to load, when the project imports a Swift package that imports and uses WebKit. I'm on macOS 15.5. Tried also to bring minimum targets of both the project and the package to 15.0. I see that there are some work-arounds for iOS simulator but nothing for the Mac. Anyone facing the same problem?

https://streamable.com/y16s4q When I leave the Spotify Web Player open on its homepage and remain completely idle (without any physical user interaction or clicks), the page somehow self-triggers an active audio stream. Instantly, Safari's standard "This tab is playing audio" speaker icon appears normally on the right side of the URL/Address bar. Simultaneously, the browser emits a 1–2 second burst of extremely accelerated, fast-forwarded, and chaotic audio (resembling a time-stretch or "Alvin and the Chipmunks" effect) before going silent or stabilizing.

I’m adding 5G network slicing support to a web browser app using WKWebView. The app declares: com.apple.developer.networking.slicing.appcategory: webBrowser-9003 com.apple.developer.networking.slicing.trafficcategory: defaultslice-1 The documentation says that apps should also set networkServiceType on URLRequest or URLSessionConfiguration. However, most requests made by a WKWebView, including subresources, JavaScript fetches, and WebSockets, are created internally by WebKit. Is declaring webBrowser-9003 and defaultslice-1 sufficient for WKWebView traffic, or is there a supported way to configure the network service type for the entire WKWebView network session?

In iOS 26.4 beta, I noticed that when loading pages using WKWebView and using WebSocket to establish IP type addresses, the connection duration was several seconds and sometimes even failed to connect (normally, the connection duration should be in milliseconds). However, when establishing WebSocket connections using domain names, the connections were normal. Additionally, I discovered a special scenario: When directly establishing WebSocket connections using IP type addresses, it remained in the "connect" state. At the same time, based on Wireshark packet capture, it was found that no TCP connection was sent at this time. However, if two connections with the same address were established simultaneously, those two connections could successfully connect. This bug has seriously affected the use of my application service. Is there a chance that this version will solve the problem?

I have been working with visionOS 27's website environment features, and I have found when entering a website environment, leaving the website environment, waiting 10 seconds, and then trying to re-enter the website environment, the attempt fails. The thrown error reports: AbortError: Immersive request was superseded by another request Strangely, if I try to immediately re-enter the website environment, I succeed. I have to wait several seconds before trying to re-enter the environment to experience the failure. The workaround is to reload the page. Anyone know why this is occurring or how to avoid it? Anyone know a more graceful workaround than asking the user to reload the page? I have filed a feedback on this: FB23208345

1. System/device combinations where the issue does not occur: Physical device: iOS 26.0 (23A5318c) + iPhone 16 Pro Max 2. System/device combinations where the issue does occur: System versions: Physical device: iOS 26.0 (23A5330a), iOS 26.0 (23A340) Simulator: iOS 26.0 (23A339) Device models: Physical device: iPhone 12 Reproducible in Safari, WKWebView, and UIWebView: Yes Actual behavior In WebView (and identically in Safari): Before the keyboard is shown, header/footer elements with position: fixed are correctly aligned with the screen viewport. Scrolling up/down works as expected. After the keyboard appears, the visualViewport position changes. Bug: When the keyboard is dismissed, visualViewport.offsetTop does not reset to 0. As a result, fixed header/footer elements remain misaligned: When scrolling down, the position looks correct. When scrolling up, the header/footer are visibly offset. Steps to reproduce Focus an input field → the keyboard appears Dismiss the keyboard Observe that visualViewport.offsetTop remains >0 (does not reset to zero) position: fixed header/footer elements are misplaced relative to the screen Expected behavior After the keyboard is dismissed, visualViewport.height should return to match the layout viewport, and visualViewport.offsetTop should reset to 0. When scrolling upward, fixed elements should remain correctly positioned within the layout viewport. Minimal reproducible demo A simple HTML file containing: A header and footer with position: fixed An input element to trigger the keyboard <!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" /> <title>H5 吸顶吸底页面 Demo</title> <style> * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: Arial, sans-serif; height: 2000px; /* 设置内容高度 */ background-color: #f0f8ff; /* body 背景浅蓝色 */ padding-top: 120px; /* 预留 header 高度 */ padding-bottom: 60px; /* 预留 footer 高度 */ overflow-x: hidden; } /* 吸顶 Header */ header { position: fixed; top: 0; left: 0; width: 100%; height: 120px; background-color: #ff6b6b; /* 红色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 24px; font-weight: bold; z-index: 1000; } /* 吸底 Footer */ footer { position: fixed; bottom: 0; left: 0; width: 100%; height: 60px; background-color: #4ecdc4; /* 青绿色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 18px; font-weight: bold; z-index: 1000; } /* 输入框样式 */ .input-container { margin: 100px auto; width: 80%; max-width: 600px; text-align: center; } input[type='text'] { padding: 12px; font-size: 16px; border: 2px solid #ddd; border-radius: 8px; width: 100%; box-sizing: border-box; } input[type='text']:focus { outline: none; border-color: #4ecdc4; } </style> </head> <body> <!-- 吸顶 Header --> <header>吸顶 Header (120px)</header> <!-- 主体内容 --> <div class="input-container"> <input type="text" placeholder="请输入内容..." /> </div> <!-- 吸底 Footer --> <footer>吸底 Footer (60px)</footer> </body> </html>