In Safari on macOS 27, go to the website you want to change, click the Page menu button in the Smart Search field, and choose Describe Extension. Type what you want, and Safari either points you to a matching extension in the App Store or builds one you can try before you save it. Safari […]

The post How to make a Safari extension by describing it in macOS 27 and iPadOS 27 appeared first on The Mac Observer.

Juli Clover:

The release candidate is the final version of macOS Golden Gate that developers and beta testers will get before the software sees a public launch.

Joe Rossignol (Reddit):

Apple this week announced that macOS 27, also known as macOS Golden Gate, will be released to all users with a compatible Mac on Monday, September 14.

iOS 27, iPadOS 27, watchOS 27, tvOS 27, and visionOS 27 will be released on the same day.

Jeff Johnson:

I would like to note two bugs that I reported during the beta period that remain unfixed in the release candidates, and barring a last minute miraculous reprieve, will remain unfixed in the public releases on Monday. This is disappointing, because I thought the point of the betas was for Apple to fix the bugs found by beta testers. While these two bugs are not destructive—do not involve data loss or security issues, for example—they nonetheless did not exist in iOS 26 and macOS 26, so in this respect, Apple’s updates are making their software worse for users.

[…]

The AppleScript run by the test app requires Automation permission, so macOS shows a permission prompt. […] It actually doesn’t matter whether you select Allow or Don’t Allow! […] Either way, just selecting something in the automation permission prompt seems to trigger the bug, causing macOS to wrongly consider the app to be running in the background.

Paul Kafasis:

Unfortunately, Apple’s forthcoming tvOS 27 and HomePod OS 27 updates contain a critical bug that prevents Apple TVs and HomePods from playing AirPlay streams sent by Airfoil. If your devices update to the OS 27 versions, Airfoil will no longer be able to stream to them.

Ron Elemans:

FB24067183 Changing selection in NSTableView by moving the mouse and holding down left button, does not work anymore[…]

Kevin C:

Font Book has been crashing since beta 4 when resizing the Inspector or Sidebar. This was a further degradation over a related bug in Tahoe. So far it seems specific to Font Book.

Previously:

• Preparing to Update to Golden Gate
• Glow Leopard
• Ventura’s “Open at Login” vs. “Allow in the Background”

Se você ainda tem o hábito de abrir links do X (antigo Twitter) para ler um post isolado, sabe como a experiência costuma ser irritante: ou o site pede login, ou carrega um monte de coisas que você não quer ver, ou simplesmente trava. Foi pensando nisso que Zhenyi Tan, desenvolvedor do site And a Dinosaur, criou o Litterbox.

O Litterbox é uma extensão para Safari (iOS, iPadOS e macOS) que abre links do x.com em um popup, permitindo ler aquele post específico sem sair da página em que você está — e sem precisar visitar o X de fato. A ideia, nas palavras do próprio desenvolvedor, é simples: abrir, dar uma olhada e fechar em seguida.

Alguns detalhes de funcionamento que valem a pena destacar:

• A extensão usa a mesma API que o X utiliza para os embeds oficiais do site, então não depende de gambiarras que podem parar de funcionar a qualquer momento.
• Nenhum cookie seu é enviado quando o popup é aberto — ou seja, o Litterbox não usa sua sessão logada no X para exibir o conteúdo.
• Links que podem ser abertos dessa forma ganham uma pequena marcação ao lado (um pontinho), já que nem todo link do x.com pode ser incorporado dessa maneira — perfis de usuário, por exemplo, ficam de fora.

O Litterbox é gratuito na App Store, sem assinaturas, compras no app, anúncios ou rastreamento, e exige o iOS 18/macOS 15 ou superior.

via Daring Fireball

Try these quick tips if the Safari extensions you installed aren’t syncing across your iPhone, iPad, and Mac.

Learn how you to build your own Safari extensions with just simple text prompts on iPhone, iPad, and Mac using Apple Intelligence.

Chinese retailer AliExpress has been caught fingerprinting visitors after one of the metrics—an outdated technique that measures inaudible sounds it sends to browsers—impeded a researcher's ability to use his bluetooth headphones.

Researcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time. He set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible.

Users can't hear it, but browsers can

While investigating the odd behavior, Callaghan said he found two highly obfuscated scripts. Together, they rendered a graph that analyzed the WebAudio readings of each visiting browser. This graph acted as an oscillator that measured Sawtooth waves, which are common in output from digital audio.

Read full article

Comments

© Getty Images

Learn how to automatically group open Safari tabs in relevant topics to streamline multi-tab browsing in iOS 27, iPadOS 27, and macOS 27.

From Mail to Notes, I replaced these built-in Apple apps and tools on my Mac with third-party options — and I haven't looked back.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Apple’s iCloud Private Relay is designed to hide users’ IP addresses from websites and even from Apple itself while browsing in Safari. But according to security researchers Talal Haj Bakry and Tommy Mysk, the feature does not always work as intended because of issues in Apple’s WebKit browser engine.

The problem centers on passkeys, the password-free authentication method that is becoming more widely used. When a user authenticates with a passkey, the request is handled outside the browser itself. Private Relay only protects traffic within Safari (as an iCloud+ feature) and does not function like a full-device VPN. As a result, the authentication request can expose the user’s real IP address to the website or service.

Because the vulnerability sits in WebKit, the engine that powers every browser on iOS, the IP leak is not limited to Safari. Privacy-focused browsers such as OnionBrowser and the researchers’ own Psylo browser can also reveal a user’s IP when passkeys are used.

Re: Responsible Disclosure

We found ourselves in a bit of a dilemma with these DNS and IP leaks in WebKit and how to handle them responsibly.

We first became aware of a DNS leak in Psylo in late June 2026 after a user reported it. During our investigation, we found two… https://t.co/5kFu0jtUsJ

— Mysk (@mysk_co) August 5, 2026

The researchers have already notified OnionBrowser and the Tor Project of their findings and suggested fixes. Apple has told 404 Media that it is investigating the report. However, Bakry and Mysk noted that Apple’s response times for similar privacy issues can be lengthy; a previously reported problem with the Hide My Email feature that allowed real email addresses to leak behind aliases was not fully fixed for about a year after it was disclosed.

MacDailyNews Take: Until a fix arrives, users who rely on Private Relay for anonymity should be aware that logging in with passkeys on iOS may still reveal their IP address.

---

‎
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Apple’s iCloud Private Relay can leak your real IP address through passkey logins, researchers warn appeared first on MacDailyNews.

A newly discovered WebKit privacy leak bypasses proxy protection and iCloud Private Relay, exposing your real IP addresses and DNS data.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

I recently returned from a safari through Zimbabwe and South Africa. The high point, I’ll confess, was one wildlife encounter in particular.

Source

Set Safari to alert you when a website publishes new posts, an out-of-stock item comes back in stock, or concert tickets go on sale.

John Gruber (Mastodon):

In most Mac apps, since the dawn of time, if there is nothing selected to be copied, the Edit → Copy (and Cut) commands are disabled. If you invoke the ⌘C shortcut while the Copy command is disabled, you hear an alert sound, letting you know that whatever you thought you were copying could not be copied because it wasn’t selected. That beep is useful context. This is proper behavior for all menu items — if they’re not available to do something, they should be disabled, and invoking a disabled menu item keyboard shortcut should beep. In any app that uses WebKit, since early in 2025, the Copy command is always enabled when a WebKit view has focus — but if nothing is selected, you get useless clipboard data that can’t actually be pasted anywhere. (And whatever was on your clipboard is now gone, or pushed back if you use a clipboard history utility.)

Jeff Johnson:

I decided to file a bug report on behalf of Gruber: Copy main menu item is enabled with no selection in the web page. I subsequently learned that the first appearance of the bug was January 2025 in the WebKit source code, February 2025 in Safari Technology Preview 213, and March 2025 in Safari 18.4, as a result of attempting to fix another bug, document.execCommand("copy") only triggers if there is a selection, reported in 2016, nine years prior!

[…]

Sadly, my bug report was closed with the resolution “won’t fix.” The refusal appears to be based on a misunderstanding[…]

Jeff Johnson:

LOL that was fast.

Sometimes Apple is hilarious.

Previously:

• Web Pages Can Overwrite Your Clipboard

Update (2026-07-30): Saron Yitbarek (via Jeff Johnson):

Fixed the Edit menu’s Copy item being incorrectly enabled when there was no selection in the web page.

Hartley Charlton (9To5Mac):

Apple today announced that the Passwords app can now automatically update weak and compromised passwords using Apple Intelligence and Safari to take action on a user’s behalf.

[…]

Apple describes the system as agentic, with Apple Intelligence and Safari securely navigating through websites, signing in, and upgrading accounts to strong passwords without the user needing to intervene beyond an initial tap.

Craig Hockenberry:

Raise your hand if you’re going to trust an AI agent with your passwords.

Maybe it’s architected so that the agent doesn’t see the actual passwords, but I find the idea of this ghost surfing through sites, logged in as me, really creepy.

Rob Mathers:

I still see Safari failing to save generated passwords in some cases.

Previously:

• Apple Intelligence in appleOS 27
• Safari 27 Announced

Update (2026-07-15): Dan Moren:

Passwords has an agentic AI feature that will scan your list of compromised passwords and then present you with a list of the ones it believes it can update for you. Even on that subset though, my experience was uneven, with just 5 of 18 updated. It’s a very cool idea, and should hopefully see improvements as the technology progresses, but right now it’s hit or miss.

Tim Hardwick:

Apple’s new version of Safari browser in macOS 27 and iOS 27 can be tasked to monitor a webpage and notify you of any changes, thanks to a new built-in feature.

[…]

In other upcoming feature additions, using the power of AI, Safari tabs that you have open can automatically be organized into topics.

Saron Yitbarek et al.:

Don’t miss our WWDC26 sessions on web technology, including What’s new in WebKit for Safari 27, to go deeper on our work in this release. Now, let’s dig into this beta, packed with 58 new features, 525 fixes and 4 deprecations that will hopefully make your work as a web developer a little easier.

Saron Yitbarek:

This year, the WebKit team is here with six sessions covering new CSS layouts, customizable form controls, 3D models, immersive spatial experiences, and browser extensions.

See also: Safari 27 Beta Release Notes.

Previously:

• WWDC 2026 Keynote
• iOS 26.2: App Marketplaces and Search Engine Choice in Japan
• How Safari Search Engine Extensions Work

Update (2026-06-17): Jeremy Keith:

But credit where credit is due. The upcoming version 27 of Safari is looking very good.

That’s not because it’s at the cutting edge of the latest web standards. Quite the opposite. Most of the changes listed for this release are bug fixes. That’s what I want to acknowledge and applaud.

Previously:

• Glow Leopard

Saron Yitbarek, writing on the WebKit blog:

In Safari Technology Preview 247, we’re introducing the Safari MCP server — a Model Context Protocol server for web developers that makes your web development and debugging workflow faster and more powerful. We know agents are increasingly integral to the coding process and the Safari MCP server gives your agent the ability to know how your code actually renders in the browser by connecting it to a Safari browser window.

Any MCP-compatible client can connect to the Safari MCP server. By connecting your agent to a Safari browser window, your agent can emulate what your users experience, giving it the information it needs to debug more autonomously, like access to the DOM, network requests, screenshots, and console output.

Importantly:

The Safari MCP server runs entirely on your local machine and makes no network calls of its own. It also does not have access to your personal information in Safari (e.g. AutoFill or other browser activity). When it captures page content, screenshots, or console logs, that data goes directly to the agent you’re running — not to Apple. What happens to that data from there depends on the agent and model you’re using. As with any agent you give access to your browser, only use ones you trust.

For the past few months, I’ve been using Google Chrome on my MacBook Pro and Mac Studio not because I like the browser (in fact, I really dislike Chrome’s text rendering and UI), but simply because it was the best option for agents. In Codex specifically, between Playwright, Chrome Dev Tools, and OpenAI’s own Chrome extension, I could kick off research tasks (such as vacation planning and booking a hotel) that involved a browser directly from my iPhone, letting Codex drive the research on my remote Mac.

Now, thanks to Safari’s new MCP server, I no longer have to use Chrome on desktop and can return to a unified browser setup across all my devices. Even better: it actually looks like Apple shipped the most ergonomic browser MCP for agents to date. The MCP server has dedicated tools for page extraction (including getting webpages as Markdown, based on WebKit’s own conversion pipeline), evaluating JavaScript, DOM interactions (clicking, scrolling, resizing the viewport for mobile screens, etc.), taking screenshots, and more. I set this up immediately in Codex, and I also asked Codex about comparing Safari’s MCP to its own Chrome extension and the older Playwright. The verdict: although Chrome has a richer API with Chrome Dev Tools when it comes to network requests, Codex actually preferred Apple’s leaner, more direct approach for letting an agent drive and debug a browser.

I’m really happy to see folks at Apple embrace agentic tools: between the new MCP capabilities of Xcode and now this, it looks like Apple’s software (on the Mac, of course) is becoming more and more approachable by people who are working in new ways thanks to agents. Whether you’re a web developer or tinkerer, I highly recommend checking out what Apple has released in Safari Technology Preview. More of this, please.