The issue is ridiculous. We also reported it in FB23265799, hopefully it will help prioritize it. I actually think this is a critical bug. The assumption that "the current user is UID 501" only holds true for a single-user Mac that has never had its primary account deleted or recreated so URL filtering API is broken for all shared / family /corporate Macs, also probably reinstalled or migrated macOS might not work as well.

Please note that regardless of the product the current behavior is inconsistent not just with the previous versions of macOS, but also within the current one: it's strange that iCloud Private Relay behaves differently with and without the Firewall. The bug is still there in macOS 15.1, but there's a slight change as if there was attempt to fix it, but it gets back 5-10 minutes later.

This is actually a very good question, doing anything in the extension is quite problematic with a limit that low. For instance, our use case is simple: we pass settings from the main app via a file. That file weighs more than 2MB so reading it is already problematic. We have to use some ugly workarounds and pass it in chunks instead.