On macOS 26, when a passkey sign-in flow is started in Safari or another WebKit-based browser (for example, DuckDuckGo browser), smart cards become inaccessible as soon as the password manager selection UI is shown, but only if the website offers “Security Key” as one of the passkey storage/authentication options. At that moment, it appears the system starts polling connected smart cards and does not properly release the transaction/session. As a result, other applications and libraries can no longer communicate with the smart card until the passkey UI is dismissed, and in practice the card may remain unavailable until the passkey sign-in flow is fully completed. This does not happen in Chrome. This does not happen if the website does not offer the “Security Key” option. This does not happen during passkey registration; the issue affects sign-in only. From our investigation, Safari/WebKit appears to open communication with connected smart cards and keep the transaction/session active. Because of that: • our own smart card code blocks while waiting for a PC/SC transaction to begin; • the system pcsctest utility also hangs and does not continue until the passkey selection UI is closed; • a minimal sample using TKSmartCard also blocks on beginSession(). This suggests the smart card is locked not only at the PC/SC level, but also at the CryptoTokenKit level. This issue is critical for us. We are developing a password manager that supports storing keys on a smart card, and due to this behavior we cannot access our card while Safari/WebKit is showing the passkey flow. Is there any way to stop safari from accessing smartcards? Any terminal commands/settings/workarounds?

Hello. I am using Cordova Webview to select a photo from the album, save it locally, and then pass the saved path to the web for display. It displayed correctly up to OS 26.3.x, but starting from OS 26.4.x, I am unable to retrieve images from local paths. Part displayed in Cordova Webview I have also confirmed the existence of the corresponding file in the src path. Are there any known bugs or solutions? Thank you.

I have an app which has at least two extensions: A Content Blocker extension with a request handler that returns an appropriate NSExtensionItem as part of beginRequest. A different file URL is returned depending upon if the content blocking is on or off by a user setting A Safari Web Extension that includes a toolbar button and popover that enables users to enable or disable the ad blocking of the content blocker extension All three targets (App, Content Blocker appex and Web Extension appex) use an App Group default to read and set the on or off status of the content blocking. When the user changes the content blocking status, the app group default is updated and SFContentBlockerManager.reloadContentBlocker(...) is called. The Content Blocker extension reads the default and then returns the appropriate file URL. The issue is, I have noticed that whenever SFContentBlockerManager.reloadContentBlocker(...) is called from the app, Safari always applies the correct rules from the returned file URL. However sometimes when SFContentBlockerManager.reloadContentBlocker(...) is called from the Safari Web Extension using native messaging, Safari does NOT apply the correct rules from the returned file URL. Using logging I have confirmed that the Content Blocker extension always returns the appropriate file URL irrespective if called as a result of the app or the web extension. Despite this, Safari does not seem to always apply the returned file URL rules when it is called from the Safari Web Extension appex. In these cases, quitting Safari and relaunching it seems to make it apply the rules correctly (obviously this is applying it due to its launch state, not due to the Web extension appex asking it to do so at that point). All targets have access to the App Group location where the active content blocking file URL belongs and the inactive content blocking file URL is within the Safari content blocker target as a resource. I don't think this is a memory status issue as I cannot see the Content Blocker extension being killed when it returns complex rules --- the fact it always works when called via the app also seems to rule this possibility out. This brings up a number of questions: Is calling SFContentBlockerManager.reloadContentBlocker(...) from a different appex, of the same app target and app group supported? (it seems to work sometimes and did work in previous versions of the app). Is there an issue that the Content Blocker extension sometimes returns a file URL that perhaps the calling Web Extension appex may not have access to (even though Safari should via the Content Blocker extension)? Any other ideas of why this may not be working correctly? Has anyone else experienced this? It seems to happen on both iOS and macOS Safari using the same codebase.

com.apple.WebKit.WebContent process is being killed by the kernel’s memorystatus jetsam mechanism when it exceeds the ActiveHard 2048 MB limit, even though the iPhone has 12 GB physical RAM and hundreds of thousands of free pages available. This causes the exact same WebProcess → GPUProcess crash that was reported in thread 822200, but now the root cause is clearly visible in the kernel log. The crash only occurs on iPhones, never on iPads (even older ones). Environment Failing devices: iPhone 17 Pro (12 GB RAM) x 2 — iOS 26.3, 26.4, 26.4.1 Working devices (same page, same iOS): iPad Pro 2018 — iOS 26.1 (stable) iPad Pro 2025 — iOS 26.4 (completely stable) Reproduces in Safari and in WKWebView (Capacitor/Ionic app) Actual Logs (kernel + WebKit) `logApr 15 21:23:33 iPhone kernel[0] : memorystatus: com.apple.WebKit.WebContent [1596] exceeded mem limit: ActiveHard 2048 MB (fatal) Apr 15 21:23:33 iPhone kernel[0] : memorystatus: killing process 1596 [com.apple.WebKit.WebContent] in high band FOREGROUND (100) - memorystatus_available_pages: 196999 0x1110ec640 - [PID=4689] WebProcessProxy::didClose: (web process 0 crash) 0x1110ec640 - [PID=4689] WebProcessProxy::processDidTerminateOrFailedToLaunch: reason=Crash 0x117048018 - [pageProxyID=7, webPageID=8, PID=4689] WebPageProxy::processDidTerminate: (pid 4689), reason=Crash 0x1130e8640 - [PID=0] WebProcessProxy::gpuProcessExited: reason=IdleExit ... (multiple RBSRequestErrorDomain Code=4 "Target process has a higher termination resistance..." errors)` Expected Behavior With 12 GB RAM and ~197k free pages, the WebContent process should not be killed at only 2 GB. The same heavy animation page runs stably on iPad (which apparently has a higher ActiveHard limit for WebKit). Additional Notes This is not a leak in the web page itself — the crash happens even when total system memory is plentiful. The 2048 MB ActiveHard limit appears to be applied specifically to iPhone device class, while iPad gets a more generous budget. The issue has existed since at least iOS 26.3 and affects both Safari and embedded WKWebView. This seems like an overly aggressive jetsam policy for WebKit on iPhone compared to the available hardware. Could the WebContent process’s memory limit be increased for modern iPhones (12 GB+ models)? Increased Memory Limit not worked for com.apple.WebKit.WebContent. I can only add this to my app. Thank you!

I'm experiencing a native crash on iOS 26+ with WebKit with title: EXC_BAD_ACCESS (KERN_INVALID_ADDRESS). The stack trace points to UIKit/WebKit animation and context menu handling, and the crash occurs while a WebView is presented or dismissed. Crashed: com.apple.main-thread 0 WebKit 0x7bcfac <redacted> + 12 1 WebKit 0xaf5c34 <redacted> + 84 2 UIKitCore 0x34ebdc -[_UIContextMenuAnimator performAllCompletions] + 248 3 UIKitCore 0x7f997c block_destroy_helper.72 + 1840 4 UIKitCore 0x7fb4b4 objectdestroy.36Tm + 88 5 UIKitCore 0x7ad354 objectdestroy.3Tm + 30500 6 UIKitCore 0x5c0e5c __swift_memcpy192_8 + 4352 7 UIKitCore 0x21944 block_copy_helper.374 + 40 8 UIKitCore 0x1dc174 -[_UIGroupCompletion _performAllCompletions] + 160 9 UIKitCore 0x35d0c4 -[_UIGravityWellEffectBody .cxx_destruct] + 180 10 UIKitCore 0x215018 -[UIScrollView _contentLayoutGuideIfExists] + 72 11 UIKitCore 0x943e4 NSStringFromUIEdgeInsets + 304 12 UIKitCore 0x94348 NSStringFromUIEdgeInsets + 148 13 UIKitCore 0x8f598 __UIVIEW_IS_EXECUTING_ANIMATION_COMPLETION_BLOCK__ + 36 14 UIKitCore 0x1995d8c -[UIViewAnimationBlockDelegate _sendDeferredCompletion:] + 92 15 libdispatch.dylib 0x1adc _dispatch_call_block_and_release + 32 16 libdispatch.dylib 0x1b7fc _dispatch_client_callout + 16 17 libdispatch.dylib 0x38b10 _dispatch_main_queue_drain.cold.5 + 812 18 libdispatch.dylib 0x10ec8 _dispatch_main_queue_drain + 180 19 libdispatch.dylib 0x10e04 _dispatch_main_queue_callback_4CF + 44 20 CoreFoundation 0x6a2b4 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16 21 CoreFoundation 0x1db3c __CFRunLoopRun + 1944 22 CoreFoundation 0x1ca6c _CFRunLoopRunSpecificWithOptions + 532 23 GraphicsServices 0x1498 GSEventRunModal + 120 24 UIKitCore 0x9ddf8 -[UIApplication _run] + 792 25 UIKitCore 0x46e54 UIApplicationMain + 336 26 - 0xedf88 main + 24 (AppDelegate.swift:24) 27 ??? 0x196686e28 (Missing)

Summary Our app’s WKWebView triggers a WebContent / GPU process crash on iPhone 15 running iOS 26.4. The same flow works on iPad running iOS 26.4. Environment Failing: iPhone 15, iOS 26.4 Working: iPad, iOS 26.4 Web stack: WKWebView / WebKit (Safari & Web) What we see The WKWebView web process terminates; logs show WebProcess and GPU process exits, followed by RBS assertion failures and (in one WebContent process) repeated containermanagerd XPC invalidation. Expected Web content loads and remains stable like on iPad 26.4. Actual Web process crashes; page goes blank or WebView recovers only after reload. Logs 0x10715d518 - [pageProxyID=14, webPageID=15, PID=3629] WebPageProxy::dispatchProcessDidTerminate: reason=Crash\ 0x10715ce18 - [pageProxyID=22, webPageID=23, PID=3629] WebPageProxy::dispatchProcessDidTerminate: reason=Crash\ 0x1480f01e0 - GPUProcessProxy::didClose:\ 0x1480f01e0 - GPUProcessProxy::gpuProcessExited: reason=Crash\ 0x14808c640 - [PID=3633] WebProcessProxy::gpuProcessExited: reason=Crash\ 0x14808cb80 - [PID=3634] WebProcessProxy::gpuProcessExited: reason=Crash\ WebContent[3633] 0x10d07ebc0 - GPUProcessConnection::didClose\ Error acquiring assertion: <Error Domain=RBSAssertionErrorDomain Code=2 "Specified target process 3630 does not exist" UserInfo=\{NSLocalizedFailureReason=Specified target process 3630 does not exist\}>\ 0x148128600 - ProcessAssertion::acquireSync Failed to acquire RBS assertion 'XPCConnectionTerminationWatchdog' for process with PID=3630, error: (null)\ WebContent[3634] XPC connection to containermanagerd invalidated. Retry attempt 1 of 6\ WebContent[3634] XPC connection to containermanagerd invalidated. Retry attempt 2 of 6\ WebContent[3634] XPC connection to containermanagerd invalidated. Retry attempt 3 of 6\ WebContent[3634] XPC connection to containermanagerd invalidated. Retry attempt 4 of 6\ WebContent[3634] XPC connection to containermanagerd invalidated. Retry attempt 5 of 6\ WebContent[3634] XPC connection to containermanagerd invalidated. Retry attempt 6 of 6\ WebContent[3634] _container_query_get_result_at_index: error = 2\uc0\u8594 (51) XPC_INVALID_REPLY;\ WebContent[3634] container_system_group_path_for_identifier: error = ((container_error_t)51) XPC_INVALID_REPLY\ WebContent[3634] 0x11107ebc0 - GPUProcessConnection::didClose\

Reproduction Steps:a. Create a WKWebView instance and set a custom string to customUserAgent.b. Load any web page (e.g., https://example.com).c. Check the User-Agent field in the request headers via packet capture tools or Web Inspector. Expected Result:The custom User-Agent should be appended to the default system identifier (Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15...), instead of being completely overwritten. Actual Result:The User-Agent is fully replaced with: NetworkingExtension/8624.1.16.10.6 Network/5812.102.3 iOS/26.4, and all basic system identifiers are missing. Additional Information: Device: iPhone 16 Pro Max iOS Version: 26.4 (Build 20T5127) WKWebView setup: Directly set using the customUserAgent property Network Extension features are not used in the project, but the NetworkingExtension identifier still appears in the User-Agent

Under iOS 26 or macOS 26 I experience some issues when trying to delete certain cookies via WKWebsiteDataStore.httpCookieStore.deleteCookie(). Most cookies can be deleted just fine, but a few simply can not be deleted anymore. Calling the deleteCookie() function with a valid cookie (retrieved via getAllCookies()) does nothing. This is not an issue under iOS 18.x or macOS 15.x or older. Looking at the exact cookie data does not show anything special which would explain why certain cookies can't be deleted anymore. It is still possible to delete cookies via WKWebsiteDataStore.removeData(ofTypes:, for:), but of course then much more data is deleted, not just individual cookies. So this is not a solution, because it is important to be able to delete individual cookies. Does anyone has a workaround or solution for this macOS/iOS bug?

In iOS 26.4 beta, I noticed that when loading pages using WKWebView and using WebSocket to establish IP type addresses, the connection duration was several seconds and sometimes even failed to connect (normally, the connection duration should be in milliseconds). However, when establishing WebSocket connections using domain names, the connections were normal. Additionally, I discovered a special scenario: When directly establishing WebSocket connections using IP type addresses, it remained in the "connect" state. At the same time, based on Wireshark packet capture, it was found that no TCP connection was sent at this time. However, if two connections with the same address were established simultaneously, those two connections could successfully connect. This bug has seriously affected the use of my application service. Is there a chance that this version will solve the problem?

Whenever I call allDataStoreIdentifiers the app just crashes, tested on both iOS 26.1 simulator and iOS 18.7 device. #0 0x00000001b0d958fc in WTF::RunLoop::dispatch () #1 0x00000001af8e0650 in WTF::Detail::CallableWrapper<WebKit::WebsiteDataStore::fetchAllDataStoreIdentifiers(WTF::CompletionHandler<void (WTF::Vector<WTF::UUID, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&)>&&)::$_0, void>::call () #2 0x00000001b0d96eb4 in WTF::dispatchWorkItem<WTF::(anonymous namespace)::DispatchWorkItem> () #3 0x000000010bfd6064 in _dispatch_client_callout () #4 0x000000010bfc491c in _dispatch_lane_serial_drain () #5 0x000000010bfc55a4 in _dispatch_lane_invoke () #6 0x000000010bfd1894 in _dispatch_root_queue_drain_deferred_wlh () #7 0x000000010bfd0eb0 in _dispatch_workloop_worker_thread () #8 0x0000000223cbca0c in _pthread_wqthread () Enqueued from com.apple.main-thread (Thread 1) Queue : com.apple.main-thread (serial) #0 0x000000010bfc16f0 in dispatch_async_f () #1 0x00000001af8df11c in WebKit::WebsiteDataStore::fetchAllDataStoreIdentifiers () #2 0x00000001af8dff80 in +[WKWebsiteDataStore(WKPrivate) _fetchAllIdentifiers:] () #3 0x0000000104b91714 in closure #1 in closure #1 in closure #1 in SystemHealthLiveClient.load() at /Users/superx3man/Documents/Code/chefaio-app-ios/ChefAIO/Sources/View/HomeTabs/Settings/SystemHealth/SystemHealth+Client.swift:29 I'm wondering if there's a workaround on this crash.

升级到iOS18.7.7 App 使用网络访问xxxx 网址的时候报错： “此服务器的证书无效。你可能正在连接到一个伪装成“xxxx”的服务器，这会威胁到你的机密信息的安全。”

Observed versions: Reproduced on Tahoe / Safari 26 and iOS 26 Safari. Not reproduced on v18 Safari. Not reproduced in Chrome with the same reduced test setup. We are seeing a Safari-only rendering issue affecting an ad creative inside an iframe on both desktop Safari and iOS Safari. What we observe: The issue is reproducible in Safari on OS X and iOS v26. We do not reproduce it in Chrome with the same test setup. We can reproduce it in a minimal test case, outside our site app code. The issue appears tied to the rendered iframe document/layout, not our outer page layout. The problematic rendered structure inside the iframe looks like this: <div class="GoogleActiveViewElement" style="display:inline"> <ins class="dcmads" style="display:inline-block;width:320px;height:50px"> <script src="https://www.googletagservices.com/dcm/dcmads.js"></script> </ins> </div> Here is a simplified, local-reproducible version for testing: <div class="GoogleActiveViewInnerContainer" style="left:0px; top:0px; width:100%; height:100%; position:fixed; pointer-events:none; z-index:-9999;"></div> <div class="GoogleActiveViewElement" style="display:inline"> <ins class="dcmads" style="display:inline-block;width:320px;height:50px"> <script> document.write( '<a target="_blank" href="#"><img ' + 'src="data:image/svg+xml;utf8,' + encodeURIComponent( '<svg xmlns="http://www.w3.org/2000/svg" width="320" height="50">' + '<rect width="320" height="50" fill="#ffd8d8"/>' + '<text x="160" y="30" text-anchor="middle" font-family="Arial" font-size="14" fill="#222">' + 'img placeholder' + '</text>' + '</svg>' ) + '" ' + ' alt="Advertisement" border="0" width="320" height="50" style="display:block" /></a>' ); </script> </ins> </div> In Safari, this produces extra vertical spacing / cutoff above the ad. In the test code you will only notice an added top spacing, but when rendered in a live ad, the bottom gets cut off. A few details that may help: If we manually change the inner ins.dcmads from display:inline-block to display:inline, or adding overflow:hidden, the spacing issue goes away. If the loader script is moved outside the ins during manual experimentation, the issue also goes away. This makes it look like a Safari layout/rendering issue involving an inline wrapper around an inline-block ad container during script-driven rendering. Questions: Is this a known Safari/WebKit layout issue involving inline + inline-block content in iframe documents? Has there been any recent Safari/WebKit change that could affect this rendering path? Is there a preferred reduced repro format for reporting layout issues like this?

Background We are investigating Safari’s Prevent Cross‑Site Tracking feature (part of Intelligent Tracking Prevention / Link Tracking Protection) on iOS and macOS (latest versions). We fully understand and respect Safari’s privacy objectives and are not requesting any whitelisting or relaxation of protections. Our goal is to understand how Safari determines when and where query parameter stripping is applied, so we can design a compliant and predictable implementation. Based on public WebKit and privacy documentation, it is understood that Safari’s tracking prevention behavior may be influenced by: Tracker classification sources such as: DuckDuckGo Tracker Radar https://github.com/duckduckgo/tracker-radar EasyList / EasyPrivacy https://easylist.to/easylist/easyprivacy.txt WebKit privacy architecture and heuristics, including behavior described in: WebKit “Private Browsing 2.0” / Link Tracking Protection documentation https://webkit.org/blog/15697/private-browsing-2-0/ Request for Guidance To help us align fully with Safari’s privacy model, we respectfully request guidance on: How Safari determines, at a domain or subdomain level, when to apply query parameter stripping under Prevent Cross‑Site Tracking. Whether evaluation may be influenced by: Tracker classification sources (e.g., domain reputation or known tracking endpoints) Runtime network behavior (such as cross‑site analytics requests) Subdomain‑specific context or historical behavior Whether Prevent Cross‑Site Tracking is evaluated: Per navigation event Per domain or subdomain Based on cumulative or runtime signals Whether Apple recommends specific design patterns or alternatives for handling essential, non‑tracking URL data in a way that is compatible with Safari’s privacy protections. Our objective is to design a solution that respects Safari’s intent and avoids reliance on fragile or unpredictable URL‑based behavior.

Hi team, may I know how I can access the report for the Safari Smart App Banner here please? We want to know how many people taps to views or install the app from that specific banner. Please advise on this. Thank you.

I want to build a WebKit website, specifically for AI coding. Is there a custom code design or application code for this? I've already implemented a few SEO optimizations on my homepage. Could you please check and reply? seokurdu.com