I am implementing push notifications using Web Push for a web application running as a PWA on iPad. When sending a push notification to the web application, the push service returns an HTTP 200 response. However, no notification is displayed on the PWA, and the Service Worker's push event is not triggered. If I create a new push subscription and send the notification using the newly issued endpoint, notifications start working again. Notifications are not disabled in the iPad notification settings, so I would like to understand what could cause this situation. I am using a commonly used JavaScript Web Push library to send the push notifications. I would also like to know whether there is any way to detect or confirm that a push subscription is in this state, other than observing that notifications are no longer being delivered. In particular, if the push service returns HTTP 200 but the notification is not delivered and the Service Worker's push event is not triggered, is there any way for the application server or the PWA to determine that the existing push subscription is no longer usable and needs to be renewed?

I filed FB24577577 about the Dock disappearing after WKWebView element fullscreen in a macOS accessory app. I retested the original minimal reproduction on macOS 27.0 (26A428), and the symptom still occurs on the built-in display alone. Is this combination of public AppKit/WebKit APIs supported? Is there an application-side workaround that preserves both an accessory activation policy and a window that joins all Spaces? Reproduction The app uses: NSApplication.ActivationPolicy.accessory (no Dock tile). NSWindow.CollectionBehavior.canJoinAllSpaces on the window hosting the WKWebView. WKPreferences.isElementFullscreenEnabled = true. Element.requestFullscreen() to enter fullscreen. A normal titled window at normal window level and a local HTML page containing a single div are sufficient. No external website, video, networking, custom window subclass, or private API is involved. The key AppKit/WebKit configuration is: NSApplication.shared.setActivationPolicy(.accessory) window.collectionBehavior = [.canJoinAllSpaces] configuration.preferences.isElementFullscreenEnabled = true Load a local HTML page with one clickable div whose click handler calls requestFullscreen() on that element. Keep the application running and retain the window/web view. With Dock auto-hide disabled, enter element fullscreen, then exit and inspect the Dock. The macOS 27 retest entered by evaluating a click on the div through WKWebView.evaluateJavaScript, confirmed document.fullscreenElement was non-null, and exited with document.exitFullscreen(). The original macOS 26 testing also reproduced with Escape. Expected: the Dock resumes its normal always-visible behavior after fullscreen ends. Actual: the right-side Dock disappears despite auto-hide remaining disabled. macOS 27 retest (September 16, 2026) macOS 27.0, build 26A428. NSScreen enumerated exactly one built-in display at the start of this run. Dock on the right, auto-hide disabled throughout. Fullscreen entry was confirmed, and document.fullscreenElement was null after exit. Both NSApp.presentationOptions and NSApp.currentSystemPresentationOptions returned to 0. The Dock was visually absent after exit. Its on-screen window count changed from 1 to 0 and was still 0 six seconds later. Window counts were supporting evidence, not the sole visual criterion. An external display was reconnected later, so this retest does not establish indefinite persistence or that restarting Dock is the only recovery route. Earlier comparisons and product impact The original report was reproduced on macOS 26.6.2 (25G83). In those earlier comparisons, removing canJoinAllSpaces avoided the symptom; using native AppKit window fullscreen instead of WebKit element fullscreen also avoided it. These controls were not rerun on macOS 27. Restarting Dock restored it in the earlier tests. This affects Nifro, a desktop-wallpaper app using WKWebView. The current app keeps element fullscreen disabled. Joining all Spaces and having no Dock tile are useful parts of its wallpaper behavior, so changing either has a product cost. Could an AppKit/WebKit engineer advise whether this is an unsupported configuration or a system issue tracked by FB24577577, and whether a supported public-API workaround exists? I can provide further targeted diagnostics if needed.

I've implemented Apple Pay payments in my website. I'm using live environment and real card and not the sandbox. Everything works fine till the last step. When I have to make payment it does not show the pay button or Pay with Touch ID option on Apple paysheet.

Has anyone else observed intermittent first-navigation failures in Safari on iOS 26 when HTTP/3 0-RTT resumption is available? Environment: iPhone 16 Pro, iOS 26.5.2 (23F84), Mobile Safari Wi-Fi with native IPv6 Cloudflare-proxied HTTPS hostname Normal browsing, not Private Browsing Reproduced almost daily on the first visit; an immediate reload succeeds Safari shows its native “cannot open the page because the server cannot be reached” page. The origin is healthy and neither the origin nor Cloudflare HTTP/security analytics records a corresponding HTTP failure. We captured the iPhone network interface over USB and compared a failed navigation with the successful reload. Failed navigation: DNS A, AAAA and HTTPS/SVCB answers completed normally. The HTTPS record advertised h3 and h2 with IPv4 and IPv6 hints. MobileSafari/WebKit opened several QUIC connections across the available IPv4 and IPv6 endpoints. Nearly all sent QUIC Initial packets plus 0-RTT application data. The edge replied promptly with Initial, Handshake and protected packets on both address families. Several flows did not settle and the edge retransmitted repeatedly. Safari also established a TCP/TLS fallback and received data, but still declared the navigation failed. Successful reload: One IPv4 QUIC connection. Full handshake, without 0-RTT. Normal bidirectional protected traffic and the page loaded. Control tests: Another proxied hostname succeeded with a full HTTP/3 handshake and no 0-RTT. A direct, non-proxied hostname succeeded over IPv6/TLS. HTTP/3 requests from the same Safari version otherwise received normal 200/204/302/304 responses. This looks like a CFNetwork/Network.framework/libquic session-resumption or connection-racing recovery issue rather than a WebKit rendering or origin-server problem. The encrypted capture does not let us determine whether the early data was accepted or rejected by the edge. Feedback filed: FB23764937. Important reproduction note: 0-RTT has now been disabled on the affected production zone while HTTP/3 remains enabled. Therefore that hostname can no longer reproduce the original 0-RTT path. This is an intentional mitigation; it will not be re-enabled on production solely for testing. Questions: Has anyone seen the same first-load failure followed by a successful reload on iOS 26? Is there a recommended way to collect CFNetwork/libquic diagnostics for a failure that occurs before an HTTP response exists? Should Safari replay the navigation after 0-RTT rejection or use the already-successful TCP/TLS fallback in this situation? A raw packet capture is available to Apple through the private Feedback report on request, but is not posted publicly because it contains client network identifiers.Has anyone else observed intermittent first-navigation failures in Safari on iOS 26 when HTTP/3 0-RTT resumption is available? Environment: iPhone 16 Pro, iOS 26.5.2 (23F84), Mobile Safari Wi-Fi with native IPv6 Cloudflare-proxied HTTPS hostname Normal browsing, not Private Browsing Reproduced almost daily on the first visit; an immediate reload succeeds Safari shows its native “cannot open the page because the server cannot be reached” page. The origin is healthy and neither the origin nor Cloudflare HTTP/security analytics records a corresponding HTTP failure. We captured the iPhone network interface over USB and compared a failed navigation with the successful reload. Failed navigation: DNS A, AAAA and HTTPS/SVCB answers completed normally. The HTTPS record advertised h3 and h2 with IPv4 and IPv6 hints. MobileSafari/WebKit opened several QUIC connections across the available IPv4 and IPv6 endpoints. Nearly all sent QUIC Initial packets plus 0-RTT application data. The edge replied promptly with Initial, Handshake and protected packets on both address families. Several flows did not settle and the edge retransmitted repeatedly. Safari also established a TCP/TLS fallback and received data, but still declared the navigation failed. Successful reload: One IPv4 QUIC connection. Full handshake, without 0-RTT. Normal bidirectional protected traffic and the page loaded. Control tests: Another proxied hostname succeeded with a full HTTP/3 handshake and no 0-RTT. A direct, non-proxied hostname succeeded over IPv6/TLS. HTTP/3 requests from the same Safari version otherwise received normal 200/204/302/304 responses. This looks like a CFNetwork/Network.framework/libquic session-resumption or connection-racing recovery issue rather than a WebKit rendering or origin-server problem. The encrypted capture does not let us determine whether the early data was accepted or rejected by the edge. Feedback filed: FB23764937. Important reproduction note: 0-RTT has now been disabled on the affected production zone while HTTP/3 remains enabled. Therefore that hostname can no longer reproduce the original 0-RTT path. This is an intentional mitigation; it will not be re-enabled on production solely for testing. Questions: Has anyone seen the same first-load failure followed by a successful reload on iOS 26? Is there a recommended way to collect CFNetwork/libquic diagnostics for a failure that occurs before an HTTP response exists? Should Safari replay the navigation after 0-RTT rejection or use the already-successful TCP/TLS fallback in this situation? A raw packet capture is available to Apple through the private Feedback report on request, but is not posted publicly because it contains client network identifiers.

Although I have reduced my Mac's MTU to solve the MTU blackhole problem, Safari is quite slow if I enabled iCloud private relay (scenario 1). At the same time, Chrome functions normally. When I turns off iCloud private relay, the Safari's performance improves immediately. Packets captured by tcpdump at a LAN gateway (FreeBSD) shows iCloud private relay uses UDP protocol and doesn't fallback to TCP protocol. If the MTU blackhole is a problem, the connection will switch to TCP protocol, given prior tcpdump captures. I am waiting for macOS 27 Beta 5 but still no update released yet.

Is it only on my personal M4 Pro, or can someone help confirm the error? Minimal, Reproducible Example (error appears after ~18secs): https://www.oslobalanse.com Exact Environment Details: MacBook Pro, 14", November 2024. 24GB, macOS is Tahoe 26.6.2 Expected results: A kind of film strip behaviour is expected. The images should glide or pan with constant speed across screen from right to left. Images should halt until fully overlapped on left or right screen edge depending on width of image (if larger or smaller than actual window size). The loop should be continuous. Actual results (so far only confirmed on Apple M4 Pro): The only visible error is the appearance of huge black spaces when the images disappear (see after approx 18 secs). The speed of movement is also no longer constant. This bad behaviour has so far only been confirmed on Apple M4 Pro. Console Output: There are no errors visibly shown. Troubleshooting Steps Taken: I have tried and confirmed the error both on version 26.3 and 26.6. The error has also been confirme on both Safari and in Chrome. I have disabled hardware acceleration on Chrome, but it did not help.

My domain vendezo.com is completely clean on Google Safe Browsing and VirusTotal, but Safari still shows a Deceptive Website Warning. Request through websitereview.apple.com was ignored. Please help

Device: iPhone 15, iOS 26.6, Safari. Also reproduced on Android Chrome, so this is not only WebKit, but the missing rotation flag part is. Setup: a web page asks for the front camera with getUserMedia, shows it in a video element, and records with MediaRecorder. Phone held upright. What happens: Requesting portrait dimensions (width 1080, height 1920) returns the sensor's wide preset, 1920 by 1080, unrotated. exact instead of ideal gives the same or an error. aspectRatio 9/16 gives the same. Requesting landscape numbers (width 1920, height 1080) lets Safari pick the preset and rotate the picture to match how the phone is held. Even then, the video track's getSettings() reports width 1920 and height 1080, while the frame Safari draws into the video element is portrait. The preview looks right. The track lies. MediaRecorder records the unrotated sensor buffer. On older iOS the file carried a displaymatrix rotation of minus 90 degrees and players honoured it. On 26.6 that flag is gone, so the file plays sideways. Thread 786803 has other people finding the same. Workaround that works in production: Ask for the camera in landscape numbers. Do not trust getSettings(). Draw one frame of the video element onto a 16 by 16 canvas scaled from the larger reported dimension and check which corner has paint. If the bottom left is painted and the top right is not, the picture is tall. If the drawn picture is portrait but the track says landscape, record a canvas stream of the drawn picture at its own size instead of the raw track. If they agree, record the raw track. Put the H.264 High profile first in your mime type candidates. isTypeSupported says yes to Baseline and High, and list order decides, so Baseline first gives soft video. Working code, MIT, with the dead ends left in as comments: https://github.com/lagudafuadtosin/web-teleprompter (src/lib/camera.ts) Full write-up: https://dev.to/lagudafuad/why-your-web-teleprompter-records-sideways-on-iphone-and-the-fix-549m Question for Apple: is the dropped displaymatrix on MediaRecorder output in 26.x intentional, and is there a supported way to read the capture rotation off the track?

I have found a possible performance issue with the Network Extension related to NEFilterPacketProvider. When a packet filter is disabled, my Mac gets the expected Internet upload speed. When an NEFilterPacketProvider is enabled, outbound/upload throughput drops substantially. The interesting part is that this is reproducible with a deliberately minimal test provider. The test provider only: receives packets; parses headers of several common protocols; writes diagnostic information using Unified Logging; allows all captured packets. It does not intentionally delay, modify, or drop packets, and it does not perform any other heavy processing or network activity. Reproduction Run a speed test at https://yandex.ru/internet/ with the packet filter disabled; Record the outbound/upload speed; Enable the NEFilterPacketProvider; Run the same test again; The outbound speed drops significantly; Disable the provider and repeat the test — the speed returns to the previous level; The effect is particularly noticeable on the outbound/upload direction; download performance is much less affected. For example: Configuration Download Upload Packet filter disabled ~700 Mbps ~600 Mbps Packet filter enabled ~700 Mbps ~110 Mbps I've submitted a Feedback Assistant report with a minimal reproducible sample - FB24686601. The sample is attached to the feedback. Has anyone else observed a similar outbound throughput reduction when NEFilterPacketProvider is enabled? I'm particularly interested in whether this is expected overhead of the packet-filtering architecture, a known limitation, or a possible macOS/Network Extension regression.

PDF files previewed from government websites are having passwords restrictions applied to all functions - view, print etc., this was a known error a few versions back but it seems to have been reintroduced in the iPadOS27 beta. It is reproducible and I have used a Linux machine to access the same file with no errors.

I'm encountering an issue with front camera video recordings via browser (Safari/Chrome) on devices running iOS/iPadOS 18 and above: On iPad, the recorded video appears upside down. On iPhone, the recorded video is rotated 90 degrees. The rear camera functions correctly without orientation issues. This problem seems specific to browser-based recordings, as the native Camera app records videos with the correct orientation. Has anyone else experienced this behavior? Is there a known workaround or fix? The preview while recording is fine, the recorded video is oriented incorrectly.

Hello Apple engineers and developers, I’m the owner/developer of https://mated.uz/, a legitimate SaaS platform for businesses in Uzbekistan. We have been experiencing a serious issue with Safari for approximately one month: Safari incorrectly displays a red “Fraudulent Website Warning” for our website. The important part is that the problem appears to be Safari-specific. The website works normally in: Chrome Microsoft Edge Firefox other browsers The website is a legitimate business platform and does not contain phishing pages, malware, deceptive content, or attempts to impersonate Apple or another service. What we have already done We have repeatedly submitted the domain for review through Apple’s website review process, including several requests over the past month. However, the warning is still present and we have not received a clear explanation of what is triggering the classification. We have also checked the website and its infrastructure for common causes: HTTPS / TLS certificate is valid No intentional redirects to suspicious domains No phishing or credential-harvesting pages No malware No deceptive content The website works correctly in other browsers The domain is actively used by a real operating business The problem This is becoming a real business issue because users who open our website from an iPhone or Mac using Safari may see a warning that effectively tells them our business is fraudulent. For a SaaS company, this significantly damages user trust and can prevent potential customers from accessing the platform. We would really appreciate guidance from Apple engineers on the following: How can we determine why Safari has classified our domain as fraudulent? Does Safari use an independent reputation database for this warning, separate from Google Safe Browsing? Is there any technical information or diagnostic data that website owners can use to identify the reason for the classification? Is there another escalation/review channel when the standard Website Review requests do not resolve a false positive? Are there specific DNS, hosting, redirect, TLS, domain-reputation, or third-party-script signals that we should investigate? We are happy to provide screenshots, domain information, security scan results, or any other technical information required. This appears to be a false positive affecting Safari only, and we would really appreciate any guidance on how to get the domain reviewed and the warning removed. Thank you.

We’re suddenly seeing valid Apple Wallet .pkpass files blocked inside Instagram and Messenger, with a “connection is not secure” warning. The exact same file works perfectly in Safari and outside Meta apps. We’ve reproduced it with a known-valid .pkpass hosted independently, so this doesn’t appear to be related to the pass file or hosting infrastructure. Has anyone else seen this since the latest Instagram / Messenger updates? Instagram/Messenger in-app browser → blocked Safari → works Interested to hear from anyone working with Apple Wallet / .pkpass / WKWebView.

When a link contains a quote character the rendering looks off, for example https://example.com/a"b in a sentence. Is that expected behavior? Thanks.

We tested iOS 27 Public Beta 4 and encountered an issue with our web app, which runs on smartphones. There is no problem when displaying RGB images stored in our cloud system. However, when displaying CMYK images, they sometimes fail to render entirely and appear completely white. After refreshing the screen several times, the images may appear intermittently—sometimes displaying correctly and sometimes not. What could be causing this issue? Please help us.

Hi! I currently have a web extension sucessfully published to Firefox. And now I'm trying to make the same web extension available for Safari. But I am having some trouble. Steps to reproduce this issue: Through appstoreconnect I create a new app. Within the app I select the tab Xcode Cloud, and scroll down to the Safari Web Extension Packager. When I try to upload a .zip file of my extension I get the error message: "NetworkError when attempting to fetch resource." According to the docs this upload feature should be compatible with any browser. I'm using Firefox version 154 running on Linux Mint 22.3. Note to forum admins: I originally tried to post this under subtopic Web Extensions but for some reason I kept getting an error when hitting "Post". That's why I'm posting this issue under the sub-topic General.

I’m the owner of sofiaproduction.ru, a legitimate videography portfolio website. Safari on iPhone continues to display a red “Fraudulent Website Warning”. The warning is reproducible on multiple iPhones and networks. The website has no login, payments, downloads, deceptive redirects, or forms requesting personal or financial information. A technical audit found no malware, phishing content, credential collection, external scripts, or TLS/DNS problems. Google Safe Browsing currently classifies the domain as clean. I have already submitted multiple requests through Apple Website Review and filed Feedback Assistant report FB24432044 with a sysdiagnose captured immediately after reproducing the warning. Apple Support confirmed that phone support cannot handle Safari website-classification issues. A separate Security Research report was closed as out of scope without being routed to the responsible team. The warning remains. Could an Apple engineer please confirm the correct escalation path or help route FB24432044 to the team responsible for Safari Fraudulent Website Warning / Safe Browsing classification? I can provide any additional technical evidence required.

Hi , I have the DB 7 of Ios 27 on 17 Pro Max and Ipad Pro M5 . This alert appeared on my iPhone for the first time yesterday whilst I was reading an online article, and it reappeared this morning. On my iPad Pro, however, it doesn’t appear… I’m also running iOS 27, build 7, on my iPad Pro.

Using the official Apple Pay JS SDK (https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js), the onvalidatemerchant event returns the validationURL: https://apple-pay-gateway.apple.com/paymentservices/startSession Our server performs merchant validation via mTLS using exactly this URL, with a valid Merchant Identity Certificate, and Apple responds with HTTP 400 Bad Request. Apple's current documentation instead references /paymentservices/paymentSession and states that "Start Session is being phased out and replaced by Payment Session". Since the URL is provided by Apple's own SDK, is startSession still valid when returned by onvalidatemerchant, and why is it rejected with 400? Anyone is experiencing this?

I am creating passkeys using client side javascript and trying to see how the friendly name of the passkey is created. When the passkey gets created the publicKey the name for the relying party is ignored and iOS and MacOS retrieves the page of the relying party. It seems the Open Graph site_name meta tag is used for the friendly name. And the apple-touch-icon is the icon on iOS (but not on MacOS) in the passwords app and it needs to be over 180px. Is there anywhere this is documented and confirmed as once the passkey is enrolled updating the site_name or apple-touch-icon the image never gets updated.