project
Apple's built-in web browser for macOS, iOS and iPadOS, powered by the WebKit engine and widely studied for security vulnerabilities.
No evidence-backed relationships are recorded.
CSS text-box-trim crops a headline's box to the font's cap height and baseline, replacing negative margins like -0.18em tuned by eye in devtools. The browser takes the numbers from the font file, so swapping the typeface or raising line-height no longer means retuning a margin.
Reality
Mermaid 12.0 re-lays out and recolours existing flowcharts, state and class diagrams by default, and requires ES2024 and Safari 17.4 or later. Three config settings restore the old look, but older browsers need a polyfill or transpile step.
Reality
Scammers wrapped the leaked DarkSword exploit chain in a fake iPhone Duo preorder page that attacks the moment it opens, before any form, tap, or download. Apple has already patched the flaws it uses, so a current iOS build is what protects a phone here.
Reality
iOS 26.6.1, iPadOS 26.6.1 and macOS Tahoe 26.6.2 close 29 flaws with no known attacks. Publication is the trigger event, and 21 of the 29 sit in WebKit.
Perspective Coverage
3 publishersReality
SlowMist says its evidence for the iPhone Safari attack on crypto wallet keys covers iOS 18.4 to 18.6.2 and that it has confirmed no theft victim. The firm calls this week's iOS 13 to 26.5 warnings preliminary and still tells iPhone users to install security updates.
Reality
TC39's iterator helpers are Baseline as of September 2026, so lazy chains run without a polyfill from Chrome 122 and Node 22 upward, while the teams reporting the 40-60% memory saving attached to them are unnamed.
Reality
The new WebKit preview matches style-originated scroll timelines globally, so a declaration no longer has to sit in the animated element's tree. Four of the seven animation entries in the notes settle which timeline a target resolves to.
Reality
INP reports the worst click of a visit. Third-party tags usually own it. Partytown runs those tags in a web worker, where every document.cookie read becomes a blocking message back to the thread you were trying to protect.
Reality
Blockchain security firm SlowMist says an active exploit chain walks from a Safari page to kernel access and the iOS Keychain on everything from iOS 13 to 26.5, while Apple's patches, by the same account, reach 26.3.
Reality
Apple deprecated WKProcessPool in macOS 12 and it no longer affects process sharing, so the data store object you hand a web view is what now determines whether two tabs share WebKit's network and content processes.
Reality
One developer's four clean runs against livekit-client 2.22.3 all read the track dimensions after the preview appeared. Reading there lands outside the roughly 100 ms window in which a portrait iPhone claims 1920 by 1080.
Reality
Apple's new Safari MCP server gives Claude Code or Codex the DOM, screenshots and console output of whatever the browser window is rendering. It stays off until a developer turns on two separate settings.
Reality
The strict-dynamic directive passes a script's trust to everything that script loads, and Ryan Chaplin of Raxis used that rule to get an XSS payload executing under a nonce-based policy that had blocked it.
Reality
When the acoustic path changes mid-playback, the browser's echo canceller stops cancelling and the leftover sound reaches the voice detector as speech. The fix was 300 extra milliseconds, applied only during playback.
Reality
Apple shipped iOS 27 this week and MacRumors counts 50 new features in what it calls a refinement year. Five of the seven features it details use Apple Intelligence, and the Wallet pass redesign is the one asking developers for work.
Reality
Apple published the security content for iOS 27 and iPadOS 27 on release day, and for anyone running a managed fleet the impacts listed there decide how long the upgrade can wait. The hardware list decides who is eligible at all.
Reality
No major browser encodes AVIF from a canvas, and the spec says to hand back a PNG without throwing. The only support test that works is reading blob.type on the blob you get back.
Reality
Wired's walkthrough of three new Safari settings in iOS 27 says they run on Apple Intelligence and need an iPhone 15 Pro or newer, so one software build will produce two different browsers inside the same fleet.
Reality
A dev.to teardown of Apple's spec sheet puts both of the new foldable's displays near the same 1:1.42 shape. The CSS spec that reports a fold runs only in Chromium, so Safari code has to work the state out from width and height.
Reality
One cached identifier was enough to retire a browser tab permanently, because every recovery path in the ownership model also demanded the proof of ownership that had just gone missing.
Reality
Build · September 8, 2026 · 1 publisher
Build · September 6, 2026 · 1 publisher
Build · September 4, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Product · August 24, 2026 · 1 publisher
Product · August 24, 2026 · 1 publisher
Build · August 24, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Security · August 19, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher
Product · August 15, 2026 · 1 publisher