Filed as FB24092251. On macOS 27.0 beta (26A5388g), clicking into any text input inside a WKWebView in a Mac Catalyst app makes focus oscillate forever and typing does nothing. CPU pegs at 100% while the editor is focused. The same binary works fine on macOS 26. The DOM element never actually loses focus. Only the window does: window focus -> activeElement=TEXTAREA.inputarea JS focus -> activeElement=TEXTAREA.inputarea window blur -> activeElement=TEXTAREA.inputarea <- window loses key status JS blur -> activeElement=TEXTAREA.inputarea <- element did not ...repeats indefinitely... Pausing during the loop shows why. Focusing the element sends WebKit into UIKit's software-keyboard machinery, on a platform that has no software keyboard: -[UIKeyboardSceneDelegate containerWindowForViewService:] -[UIKeyboardSceneDelegate _setKeyWindowSceneInputViews:animationStyle:] -[UIKeyboardSceneDelegate _reloadInputViewsForResponder:force:fromBecomeFirstResponder:] -[UIResponder(UIResponderInputViewAdditions) reloadInputViews] -[WKContentView(WKInteraction) _continueElementDidFocus:...] -[WKContentView(WKInteraction) _elementDidFocus:...] WebKit::WebPageProxy::elementDidFocus(...) Building that container steals key status from the web view. First responder ends up on the enclosing _UIHostingView, so key presses are delivered there and immediately cancelled: pressesBegan: [...], focusedItem: monacoEditor firstResponder at keypress: _UIHostingView<...> pressesCancelled: [...] The catch: -becomeFirstResponder cannot be used to recover, because it is the trigger. Calling it re-enters _elementDidFocus and re-arms the loop permanently. So there is no app-side way back — the only API that reclaims the keyboard is the one that breaks it. Minimal repro is just a WKWebView in a UIViewRepresentable inside a SwiftUI hierarchy, with any focusable . No Monaco needed. Partial mitigation, if you hit this: do not echo focus/blur commands back at the web view in response to its own focus events, and treat a blur where document.hasFocus() is false but activeElement is unchanged as a window-level blur rather than an editing-ended event. That stops the runaway loop and keeps your focus state correct — but it does not restore typing. Has anyone found a way to get first responder back to the web view without calling -becomeFirstResponder? Or a way to stop the keyboard scene delegate engaging on Catalyst in the first place? If you can reproduce on 27 beta, please file a duplicate referencing FB24092251.

On iOS 26.5, occasionally when WKWebView calls loadRequest to load a URL containing a fragment, it sends the complete URL to the backend.

Hello Apple engineers and fellow developers, Over the past few weeks I have noticed multiple reports from different developers whose legitimate websites have been classified by Safari as “Fraudulent Website Warning”, despite passing every major public security and reputation check. My websites appear to be affected by the same issue. Domains https://skvoz.net https://skvoz.org Both domains were registered on July 15, 2026. The Fraudulent Website Warning first appeared on July 22, 2026, only one week after registration. Both websites are legitimate services operated by our team. Neither website impersonates another brand, attempts to collect Apple IDs, banking credentials, passwords, or any other sensitive information through deceptive means. Extensive verification performed After the warning appeared, we performed a comprehensive technical and security review. Website security ✅ No malware detected ✅ No phishing content ✅ No unauthorized redirects ✅ No suspicious JavaScript ✅ No mixed-content issues ✅ HTTPS configured correctly ✅ Valid TLS certificates Infrastructure DNS configuration verified SSL certificate chain verified using OpenSSL Server responds correctly over HTTP/2 IPv4 and IPv6 connectivity verified Origin server behaves correctly Cloudflare configuration was thoroughly tested during troubleshooting and ultimately removed from the production setup to eliminate it as a possible cause Reputation checks We verified both domains and the hosting IP address using multiple public reputation services. Results were consistently clean. This included services such as: Google Safe Browsing Google Search Console VirusTotal URLVoid IP reputation databases None of them currently report malware, phishing activity, or any other security issues. Apple-specific actions We have already: submitted a Website Review request; contacted Apple Security via reportphishing @apple.com requesting a manual review. At the time of writing, the warning is still present. One unusual observation One particularly unusual observation is that both of our domains (skvoz.net and skvoz.org) received the warning independently. These are separate domains serving different purposes, yet both appear to have been classified in the same way despite passing the same technical and reputation checks. This made me wonder whether Apple’s reputation system may evaluate related domains or shared infrastructure together. I understand the internal implementation is not public, but I wanted to mention this observation in case it is useful during investigation. Similar reports While investigating this issue, I found several recent reports from other developers describing almost identical behavior. The common pattern is remarkably consistent: Safari displays Fraudulent Website Warning Chrome, Firefox and Edge open the website normally Google Safe Browsing reports the domain as safe VirusTotal reports no malware Google Search Console reports no security issues valid HTTPS certificates relatively new domains no explanation regarding what triggered the warning This suggests the issue may not be isolated to a single website. Questions I would greatly appreciate any guidance from Apple engineers. Does Safari rely solely on Google Safe Browsing, or does Apple maintain an independent reputation database for Fraudulent Website Warning? If Apple maintains its own reputation system, are there any documented technical signals developers should verify? For example: redirects third-party scripts TLS configuration domain age hosting reputation infrastructure characteristics phishing heuristics machine-learning based classification Is there any recommended diagnostic process beyond Website Review? Approximately how long does a manual review usually take? Why I am posting This post is not only about my own websites. Over the past few months I have noticed an increasing number of developers reporting what appear to be false positive Fraudulent Website Warnings affecting legitimate websites. If there have been recent changes to Safari’s reputation or anti-phishing systems, it would be extremely helpful for developers to better understand what technical criteria should be reviewed before requesting reconsideration. Even if the exact detection logic cannot be disclosed, any general guidance on common causes of false positives would help developers resolve issues much more efficiently. Thank you very much for your time.

webkitEnterFullScreen API is supported on iOS for video element, but not for a div element. Also as a fullscreen demo website shown, Safari on macOS supports div element but not on iOS. Is there any plan to add the support in iOS? If not is there any way to fullscreen a div element or make it run as fullscreen on Safari iOS?

Hello, I have recently discovered that our company website, https://www.cgs.com, displays the message "Website Not Allowed, cgs.com is a restricted website." when accessed via iOS Safari. After investigation, I found that this occurs when the Limit Adult Websites option is enabled under Settings → Screen Time → Content & Privacy Restrictions → App Store,Media, Web, & Games → Web Content. I believe this restriction has been applied incorrectly to our website, and I would like to formally request that https://www.cgs.com be removed from this restricted list. Please let me know if any supporting materials or documentation are required from our side. Best regards

It appears that Reality Composer Pro 3 does not export a full USDZ file with textures, animations, etc. The best I can tell is that it exports only the mesh (as suggested by the menu name). I have been using Reality Composer Pro 2 to create USDZ files to use as website environments. Will we no longer be able to create website environments with RCP 3? Will there be any way to download and use the old RCP 2 after upgrading to macOS 27 and Xcode 27?

Safari continues to display a "Fraudulent Website Warning" for openvan.camp despite the domain being clean across all major security databases for over a week. Chrome, Firefox, and all other browsers open the site without any warnings. Domain: openvan.camp Warning appeared: March 18, 2026 Warning type: Fraudulent Website Warning (red screen) Current security database status: Google Safe Browsing: ✅ Clean (transparencyreport.google.com) Google Search Console: ✅ No security issues Spamhaus DBL: ✅ Removed from blocklist Fortinet FortiGuard: ✅ Category "Travel" VirusTotal: ✅ 0/65 vendors URLVoid: ✅ 0/35 engines Steps taken: Removed the third-party ad network (Adsterra) that caused the original flag — March 18, 2026 Migrated hosting to Scaleway (AS12876, France), IP: 151.115.84.228 Configured SPF, DKIM, DMARC records Created functional abuse@ and postmaster@ role accounts Submitted review via websitereview.apple.com — no response after 5 days What we believe is happening: Apple's Safe Browsing database appears to have an independent entry for this domain that has not been updated despite all underlying security databases clearing the flag. Safari's warning persists even after deleting ~/Library/Safari/SafeBrowsing/ cache and re-downloading the database — which confirms this is not a local cache issue. Steps to reproduce: Open Safari on macOS or iOS Navigate to https://openvan.camp/ Safari displays "Fraudulent Website Warning" Open the same URL in Chrome — no warning Expected behavior: No warning should be shown. The domain is legitimate, clean, and verified. Has anyone experienced a similar issue? Is there any additional channel to escalate beyond websitereview.apple.com?

Tested iPhone 16 Pro Max running DB2 Since using iOS 27 Developer Beta, Progressive Web Apps (PWAs) and applications using WKWebView that route live streaming audio (such as Icecast/SHOUTcast streams) through the Web Audio API (AudioContext / MediaElementAudioSourceNode for canvas visualizers) experience silent playback freezes during track changes. The JavaScript context remains active, and the HTMLMediaElement reports no errors or pauses, but the low-level system audio daemon (audiod) disconnects. The logs indicate a state desynchronization in MediaToolbox triggered by inline metadata frame updates, coupled with massive sandbox violations. Steps to reproduce: Run a PWA or WKWebView on iOS 27 Developer Beta that loads a live audio stream using an tag. Route the media element into the Web Audio API (e.g., audioContext.createMediaElementSource(audioElement)). Play the stream and lock the screen or let it run in the foreground. Wait for a track transition to occur on the live stream server (which pushes an inline ICY metadata update). Observed Result: Audio instantly goes silent at the track boundary. JavaScript rendering loops remain active, but the stream is dead. List of important errors: MediaToolbox parsing failure: <<<< FigStreamPlayer >>>> fpfs_CacheRenderChain: Caching unexpected mediatype metadata Reasoning: When the stream updates its inline metadata, MediaToolbox (FigStreamPlayer) fails to handle the frame descriptor correctly, halting the stream decoder render chain. Audio engine state desynchronization: <<<< FigStreamPlayer >>>> fpfs_SetRateOnTrack: [...] setting rate on track before it has reached playing state - 4 instead Reasoning: WebKit attempts to keep playing or setting the playback rate, but MediaToolbox fails because the underlying decoder track is stuck in an uninitialized/stalled state (4). System Audio Daemon Disconnection: Subsystem: com.apple.audioanalytics | Process: audiod Reporter disconnected. ( function=sendMessage, reporterID=... ) Reasoning: Because the rendering stream stalled, the system audio daemon (audiod) forcibly severs the audio session connection to the browser container. Massive Sandbox Log Flooding (WebKit.WebContent): Sandbox: com.apple.WebKit.WebContent(2719) deny(1) syscall-unix 179 Reasoning: WebKit's WebAudio thread tries to log trace markers to XNU's kdebug_trace64 (syscall 179) but is blocked by the WebContent sandbox profile, resulting in a loop of thousands of denials that clog the thread. What needs to be fixed: MediaToolbox (FigStreamPlayer): Fix the regression where incoming live stream metadata frames stall the render chain when connected to a Web Audio node. WebKit Sandbox Profiles: Update the iOS WebContent, Network, and GPU sandbox rules to allow necessary tracing/diagnostic calls (syscall-unix 179 and mach-lookup com.apple.diagnosticd) in developer beta builds to prevent thread-blocking loops.

Canvas Previews (targeting macOS) in both Xcode 16.4 & Xcode 26 fail to load, when the project imports a Swift package that imports and uses WebKit. I'm on macOS 15.5. Tried also to bring minimum targets of both the project and the package to 15.0. I see that there are some work-arounds for iOS simulator but nothing for the Mac. Anyone facing the same problem?

https://streamable.com/y16s4q When I leave the Spotify Web Player open on its homepage and remain completely idle (without any physical user interaction or clicks), the page somehow self-triggers an active audio stream. Instantly, Safari's standard "This tab is playing audio" speaker icon appears normally on the right side of the URL/Address bar. Simultaneously, the browser emits a 1–2 second burst of extremely accelerated, fast-forwarded, and chaotic audio (resembling a time-stretch or "Alvin and the Chipmunks" effect) before going silent or stabilizing.

I’m adding 5G network slicing support to a web browser app using WKWebView. The app declares: com.apple.developer.networking.slicing.appcategory: webBrowser-9003 com.apple.developer.networking.slicing.trafficcategory: defaultslice-1 The documentation says that apps should also set networkServiceType on URLRequest or URLSessionConfiguration. However, most requests made by a WKWebView, including subresources, JavaScript fetches, and WebSockets, are created internally by WebKit. Is declaring webBrowser-9003 and defaultslice-1 sufficient for WKWebView traffic, or is there a supported way to configure the network service type for the entire WKWebView network session?

In iOS 26.4 beta, I noticed that when loading pages using WKWebView and using WebSocket to establish IP type addresses, the connection duration was several seconds and sometimes even failed to connect (normally, the connection duration should be in milliseconds). However, when establishing WebSocket connections using domain names, the connections were normal. Additionally, I discovered a special scenario: When directly establishing WebSocket connections using IP type addresses, it remained in the "connect" state. At the same time, based on Wireshark packet capture, it was found that no TCP connection was sent at this time. However, if two connections with the same address were established simultaneously, those two connections could successfully connect. This bug has seriously affected the use of my application service. Is there a chance that this version will solve the problem?