Safari could be exploited with new iLeakage attack

Safari now suffers from new exploit allowing malicious website to render arbitrary webpage and extract information out of it.

As of now, there is a workaround requiring access to developer menu on macOS.

Paste the following command in Terminal: defaults write com.apple.Safari IncludeInternalDebugMenu 1

Open Safari and select "Debug" from the menu bar, select "WebKit Internal Features" then Scroll down and click "Swap Processes on Cross-Site Window Open"

AppleInsider

It is expected that this vulnerability will be fixed by Apple in upcoming software updates.

Disclosure: iLeakage

References:

Weekend good reads for Apple developers #2023/40

This is 40th edition of good reads in this year. Let's go through today's list.

And this is it for today. We'll get back next week with another pack of great reads.

Apple releases Safari 17 for macOS Ventura and Monterey

Together with release of macOS Sonoma 14 Apple also releases Safari for previous macOS releases – Ventura and Monterey. This brings new Safari features including Profiles, Locked Private Browsing and others. It also updates WebKit to the same level as new macOS Sonoma.

Safari 17 introduces new features, even faster performance, and improved security.

  • Profiles keep your browsing separate for topics like work and personal, separating your history, cookies, extensions, Tab Groups, and Favorites
  • Enhanced Private Browsing locks your private browsing windows when you're not using them, blocks known trackers from loading, and removes identifying tracking from URLs
  • Streamlined search offers more relevant, faster, and easier-to-read results
  • Multiple tab selection allows you to select multiple tabs at once and move them around the tab bar or create a Tab Group

Some features may not be available for all regions, or on all Apple devices.

Safari 17 is available as software update in System Settings.

Reference: Apple Releases Safari 17 With Profiles, Locked Private Browsing Windows and More

Apple releases macOS Sonoma 14

Apple releases next major release of macOS – Sonoma.

macOS Sonoma brings all‑new capabilities that elevate your productivity and creativity. Discover even more ways to personalize your Mac with stunning screensavers and widgets that you can add to your desktop. Elevate your presence on video calls with a new way to present your work that keeps you a part of the presentation. Safari profiles and web apps help you organize your browsing in all-new ways. Game Mode boosts your gaming performance. Sonoma also brings big updates to Messages, Keyboard, and Accessibility. And when you upgrade, you get the latest security and privacy protections available for Mac.

Screen Savers

  • Stunning screen savers of locations from around the world seamlessly become your desktop wallpaper when you log-in
  • Shuffle settings for rotating through screensavers by theme including Landscape, Cityscape, Underwater, and Earth

Widgets

  • Widgets can be placed anywhere on the desktop and adapt to the color of your wallpaper while working in apps
  • iPhone widgets can be added to your Mac when your iPhone is nearby or on the same Wi-Fi network
  • Interactive widgets let you take actions directly from the widget such as running a shortcut, pausing media, and more

Video Conferencing

  • Presenter Overlay keeps you front and center while sharing your screen in FaceTime or third-party video conferencing apps (Mac with Apple silicon)
  • Reactions layer 3D effects like hearts, balloons, confetti, and more around you in video calls and can be triggered with gestures (Mac with Apple silicon, Continuity Camera with iPhone 12 and later)

Safari and Passwords

  • Profiles keep your browsing separate for topics like work and personal, separating your history, cookies, extensions, Tab Groups, and favorites
  • Web apps let you use any website like an app, complete with an icon in the Dock for faster access and a simplified toolbar for easier browsing
  • Enhanced Private Browsing locks your private browsing windows when you're not using them, blocks known trackers from loading, and removes tracking that identifies you from URLs
  • Password and passkey sharing allows you to easily share accounts with trusted contacts

Messages

  • Live Stickers sync from iOS and iPadOS to macOS, giving you access to the Live Stickers you create on your iPhone and iPad
  • Search filters for people, keywords, and content types like photos or links help you more easily find what you are looking for
  • Swipe to reply inline on any iMessage bubble

Gaming

Game Mode gives games the highest priority on the CPU and GPU, delivering more consistent frame rates and lower latency to wireless controllers and AirPods (Mac with Apple silicon)

Keyboard

  • Improved autocorrect accuracy makes typing even easier by leveraging a more powerful transformer-based language model
  • Inline predictive text shows single- and multi-word predictions that you can add by pressing the Space bar
  • Improved Dictation experience supports using your voice and keyboard together to enter and edit text

AirPods

  • Adaptive Audio delivers a new listening mode that dynamically blends Active Noise Cancellation and Transparency to tailor the noise control experience based on the conditions of your environment (AirPods Pro (2nd generation) with the latest firmware)
  • Personalized Volume adjusts the volume of your media in response to your environment and listening preferences over time (AirPods Pro (2nd generation) with the latest firmware)
  • Conversation Awareness lowers your media volume and enhances the voices of the people in front of the user, all while reducing background noise (AirPods Pro (2nd generation) with the latest firmware)
  • Press to mute and unmute your microphone by pressing the AirPods stem or the Digital Crown on AirPods Max when on a call (AirPods (3rd generation), AirPods Pro (1st and 2nd generation), or AirPods Max with the latest firmware)
  • Improved AirPods automatic switching now detects Mac up to 2X faster (AirPods (2nd and 3rd generation), AirPods Pro (1st and 2nd generation), AirPods Max with the latest firmware)

Privacy

  • Sensitive Content Warnings can be enabled to help prevent users from unexpectedly viewing sensitive images in Messages
  • Expanded Communication Safety protections for children now detect videos containing nudity in addition to photos shared through Messages and the system Photos picker
  • Improved sharing permissions let you choose which photos to share and add calendar events without providing access to your entire photo library or calendar

Accessibility

  • Live Speech lets you type what you want to say and reads it aloud in FaceTime calls or in-person conversations
  • Personal Voice helps users at risk of speech loss create a voice that sounds like them in a private and secure way using on-device machine learning
  • Made for iPhone compatible hearing devices can be paired and used with Mac (MacBook Pro (2021), Mac Studio (2022), and Mac computers with M2 chip)

This release also includes other features and improvements:

  • One-Time verification code AutoFill from Mail helps you quickly sign into sites in Safari, without leaving the browser
  • Inline PDFs and document scans in Notes are presented full-width making them easy to view
  • Grocery Lists in Reminders automatically group related items into sections as you add them
  • Visual Look Up for recipes helps you find similar dishes from photo
  • Visual Look Up in video helps you learn about objects that appear in paused video frames
  • Pets in the People album in Photos surfaces individual pets just like friends or family members
  • Option to say "Siri" in addition to "Hey Siri" for a more natural way to activate Siri (Mac with Apple silicon, AirPods Pro (2nd generation))
  • High performance mode in Screen Sharing supports color workflows and improves responsiveness while remotely accessing a Mac (Mac with Apple silicon)
  • Item sharing in Find My allows you to share an AirTag with up to five other people
  • Activity History in Home displays a recent history of events for door locks, garage doors, security systems, and contact sensors
  • Battery health management updated on 13-inch MacBook Air with M2 chip to better optimize long term battery health

Some features may not be available for all regions or on all Apple devices.

macOS Sonoma also includes several important security fixes.

Apple Newsroom: macOS Sonoma is available today

Release notes: macOS Sonoma 14 Release Notes

References:

Weekend good reads for Apple developers #2023/37

Well, Wonderlust event brought us new iPhones and Apple Watches. We've made our first pre-orders and now we could enjoy the weekend with some great articles to read.

And that is it for this weekend. Come back next week for more great articles!

WebKit team explains Safari profiles feature in modern Apple operating systems

WebKit team shares development techniques on Safari profiles API.

An essential requirement to implement profiles is to have separate containers for website data. In WebKit, this means the client needs to have different data stores. Before macOS 14 and iOS 17, WebKit clients could have multiple non-persistent data stores, but only one persistent data store — the default one. Non-persistent data stores do not store data to disk, so they cannot be retained across sessions.

In macOS 14 and iOS 17, we’ve introduced a new set of APIs to let clients create and manage multiple persistent data stores. Let’s take a look at how to use them to build a “profiles” feature for your app.

WebKit Blog

WebKit Blog: Building Profiles with new WebKit API

WebKit team reminds developers to adopt Storage API

WebKit team shared blog post reminding web developers to adopt Storage API to be able to use local browser storage properly with modern updates to Safari on all platforms.

Team also outlines storage quotas for applications.

The overall quota is the storage limit of all origins. Reaching the limit can lead to data eviction, which releases storage used by the app. Starting in iOS 17 and macOS 14:

  • For a browser app or a web app, overall quota is up to 80% of the total disk space.
  • For other apps, overall quota is up to 15% of the total disk space.
WebKit

WHATWG: Storage API

WebKit Blog: Updates to Storage Policy

Weekend good reads for Apple developers #2023/32

School starts in US, and we have another weekend with great reads to spend some time on.

And quick shoutout for next week's online conference – Mobile People Community Day. Join our experts with great talks on different mobile development platforms, including review of WWDC23 announcements.

Apple re-releases Rapid Security Response for iOS 16.5.1 and macOS 13.4.1

After releasing and pulling back of critical security update for iOS and macOS, Apple finally releases the updated fix.

This time fix should be adjusted for Safari user agent string.

Fix is referenced as iOS 16.5.1 (c) and macOS Ventura 13.4.1 (c).

Reference: Apple Releases Revised iOS and macOS Security Updates to Fix Actively Exploited Vulnerability and Safari Bug