We tested iOS 27 Public Beta 4 and encountered an issue with our web app, which runs on smartphones. There is no problem when displaying RGB images stored in our cloud system. However, when displaying CMYK images, they sometimes fail to render entirely and appear completely white. After refreshing the screen several times, the images may appear intermittently—sometimes displaying correctly and sometimes not. What could be causing this issue? Please help us.

Hi! I currently have a web extension sucessfully published to Firefox. And now I'm trying to make the same web extension available for Safari. But I am having some trouble. Steps to reproduce this issue: Through appstoreconnect I create a new app. Within the app I select the tab Xcode Cloud, and scroll down to the Safari Web Extension Packager. When I try to upload a .zip file of my extension I get the error message: "NetworkError when attempting to fetch resource." According to the docs this upload feature should be compatible with any browser. I'm using Firefox version 154 running on Linux Mint 22.3. Note to forum admins: I originally tried to post this under subtopic Web Extensions but for some reason I kept getting an error when hitting "Post". That's why I'm posting this issue under the sub-topic General.

I’m the owner of sofiaproduction.ru, a legitimate videography portfolio website. Safari on iPhone continues to display a red “Fraudulent Website Warning”. The warning is reproducible on multiple iPhones and networks. The website has no login, payments, downloads, deceptive redirects, or forms requesting personal or financial information. A technical audit found no malware, phishing content, credential collection, external scripts, or TLS/DNS problems. Google Safe Browsing currently classifies the domain as clean. I have already submitted multiple requests through Apple Website Review and filed Feedback Assistant report FB24432044 with a sysdiagnose captured immediately after reproducing the warning. Apple Support confirmed that phone support cannot handle Safari website-classification issues. A separate Security Research report was closed as out of scope without being routed to the responsible team. The warning remains. Could an Apple engineer please confirm the correct escalation path or help route FB24432044 to the team responsible for Safari Fraudulent Website Warning / Safe Browsing classification? I can provide any additional technical evidence required.

Hi , I have the DB 7 of Ios 27 on 17 Pro Max and Ipad Pro M5 . This alert appeared on my iPhone for the first time yesterday whilst I was reading an online article, and it reappeared this morning. On my iPad Pro, however, it doesn’t appear… I’m also running iOS 27, build 7, on my iPad Pro.

Using the official Apple Pay JS SDK (https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js), the onvalidatemerchant event returns the validationURL: https://apple-pay-gateway.apple.com/paymentservices/startSession Our server performs merchant validation via mTLS using exactly this URL, with a valid Merchant Identity Certificate, and Apple responds with HTTP 400 Bad Request. Apple's current documentation instead references /paymentservices/paymentSession and states that "Start Session is being phased out and replaced by Payment Session". Since the URL is provided by Apple's own SDK, is startSession still valid when returned by onvalidatemerchant, and why is it rejected with 400? Anyone is experiencing this?

I am creating passkeys using client side javascript and trying to see how the friendly name of the passkey is created. When the passkey gets created the publicKey the name for the relying party is ignored and iOS and MacOS retrieves the page of the relying party. It seems the Open Graph site_name meta tag is used for the friendly name. And the apple-touch-icon is the icon on iOS (but not on MacOS) in the passwords app and it needs to be over 180px. Is there anywhere this is documented and confirmed as once the passkey is enrolled updating the site_name or apple-touch-icon the image never gets updated.

Two unrelated, legitimate websites I own are both shown as "Deceptive Website — Apple has identified this website as fraudulent" in Safari (iOS + macOS), and even inside my installed PWA on iOS. This is a false positive and I can't find a working way to get Apple to remove it. Why I'm confident it's a false positive: Google Safe Browsing site status: clean Google Search Console (verified owner) > Security Issues: none Yandex Webmaster > Security: no violations VirusTotal: 0/92 detections Chrome, Firefox, Yandex Browser: NO warning on any platform Only Safari shows it, wording is "Apple has identified..." — i.e. Apple's own list, not the Google Safe Browsing feed The sites are genuinely benign: no brand impersonation, no third-party credential harvesting, no malware, no drive-by downloads. The interesting part — it's TWO unrelated sites: Site A: a small web app (SaaS with a login form) Site B: my personal developer portfolio — static, no login at all They share almost nothing: different codebase, different design, different hosting (Site A is behind Cloudflare with a Google Trust Services edge cert; Site B is a plain nginx box with a Let's Encrypt cert), different TLS issuers, different stacks. The ONLY common denominator is me as the owner/registrant (same person, same contact email, same registrar account). This makes me think the domains were clustered by registrant/owner rather than by anything on the sites themselves. The two-sites fact also rules out the usual scapegoats: it isn't Cloudflare (Site B isn't even on Cloudflare and is flagged too), nor the cert issuer, host, or stack, since those differ. What I've already done: Clicked "Report an error" on the Safari warning page Submitted the Google Safe Browsing incorrect-warning report Filed a tracked report in Feedback Assistant (FB number, status Open) Hardened both sites anyway: CSP + security headers, SPF/DKIM/DMARC, and real trust pages (About with owner identity + contact, Privacy Policy, Terms, linked from homepage and login page) It's been about a week with no response. My questions: When Google Safe Browsing is clean but Safari still flags, what feeds Apple's OWN fraudulent-site list? Is registrant/owner clustering a real mechanism here? Which removal channel actually works in practice? Realistic timeline for a false-positive removal? If one domain is cleared, does that clear the owner-level association for the other, or do I appeal each separately? Is there anything that re-triggers it? (Considering a domain migration as a last resort and want to avoid a new domain getting re-flagged.) Any first-hand experience is appreciated — the process is completely opaque.

My site formtracker.ru shows Safari's "Deceptive Website" warning. I believe it is a false positive, and I am trying to understand how the Apple-side check is reviewed, since every other signal I can measure is clean. What the site is A strength-training tracker that runs as a Telegram Mini App. There is no login form, no payment form, and no field anywhere that asks a visitor for credentials, card details or personal data — authentication happens inside Telegram, not on the page. The site does not imitate any brand or product; all content is our own. Privacy policy and terms are published at /privacy.html and /terms.html with a working contact address. What I verified Google Safe Browsing: clean VirusTotal: no detections Chrome, Firefox and other browsers on the same device: no warning The warning appears only in Safari One reproducible observation After migrating hosting I created a brand-new subdomain that had never been published, linked or crawled anywhere, pointing at the new IP. Safari flagged it immediately on first load. That strongly suggests the entry applies to the registrable domain and all of its subdomains rather than to a specific URL or IP — and therefore that nothing I change on my side (hosting, content, subdomain) can clear it. Possible contributing factor, already removed Until 19 Aug 2026 the site was hosted at 79.137.205.96. That address sits inside a range listed by Spamhaus SBL under a "bulletproof hosting" classification. The listing covers the whole /24 and the neighbouring /24s, including addresses unrelated to my service, so it was not specific to me; AbuseIPDB has zero reports for that address. I have since moved to a different provider entirely, and the current IP is clean in Spamhaus ZEN, Barracuda, SpamCop and SORBS. I am not claiming this was the cause — I have no way to know. It is simply the one negative signal I could find and verify, and it no longer applies. What I have already submitted "Report an Error" from the Safari warning screen The Fraudulent Website Warning review request form Feedback Assistant: FB24430497 One more detail The warning also appears with the device region set to Germany, so it does not appear to be region-specific. My questions Is there a review channel for the Apple-side list other than the three above, and is there any way to tell whether a submission was received at all? Since a never-published subdomain was flagged on first load, is the entry expected to apply to the whole registrable domain? If so, is a domain-level review the only path? Has anyone here had a Safari-only false positive cleared, and roughly how long did it take? I am happy to provide anything else that would help — full URLs, screenshots, timestamps.

Five of my sites are flagged by Safari's Deceptive Website Warning. They are legitimate and none of them collect credentials, imitate another brand or contain social engineering content: store-api.ru — paid access to third-party AI APIs (clearly states it is not affiliated with OpenAI, Anthropic or Google) cenwise.ru — price comparison service kirillportfolio.ru — personal developer portfolio (no login, no forms, no data collection at all) 3021.ru — habit tracking app animegenai.ru — AI image generation service All five are clean in Google Safe Browsing, Google Transparency Report, Google Search Console and Yandex Webmaster. Safari is the only place showing a warning. The flag appears to be inherited from a previous hosting provider whose IP ranges had reputation problems, and it seems attached to the domain names rather than to the current infrastructure. This is directly testable: On 20 July 2026 all sites were migrated to a new host — a single server, single IP (152.53.119.191). On that exact same server and IP, the domains created AFTER the migration are NOT flagged: filelama.com (live since 28 July, fully indexed), novelisstory.ru (25 July) and store-api.com (4 August). Only the domains that already existed under the previous host are still flagged. Same server, same IP, same certificates, same kind of content. The only variable is whether the domain existed before 20 July. store-api.ru and store-api.com are the clearest case: both are literally the same application behind the same nginx on the same IP, differing only in the domain name. The .ru is flagged, the .com is not. I submitted requests through websitereview.apple.com on 20 July and again on 11 August 2026. Neither produced a response or an acknowledgement, which as I understand is expected behaviour for that form. My questions: Is websitereview.apple.com still the correct — and only — channel for a site owner to dispute a false positive? Is there any way to confirm that a submission was received, or a typical review timeframe I should expect? Would a Feedback Assistant report under Safari add anything here, or would it simply duplicate the request?