Safari Extensions JS

As an example: uBlock Origin is a Safari Extension that simply could not function as an App Extension due to lack of APIs. It is present in the Safari Extensions Gallery, which is deprecated in Safari 12. However, the current version of uBlock Origin is broken. The only fix at this time is to install an older, developer-signed release from the homepage, which is physically impossible in Safari 12.

Safari App Extensions appears to separate “in-page JS code” from “out-of-page Objective-C code” and introduces a sandbox that protects the in-page JS code from inspection or alteration by the out-of-page ObjC code.

If I understand that correctly, then I feel this is a clear security win. It forces extensions to run in-process (with DOM access) only the code that they shipped at build time, with only a simple data structure channel available to communicate with their out-of-process component.

I’m not sure what attacks on Safari using the old extension model led Apple to sandbox and secure this, but given the “App Store” hint, it seems likely that in-browser malware extensions exist and are being installed into Safari without user consent to spy on surfing and exfiltrate data for tracking. This would be a gold mine for a government-backed attacker, as the extensions are silent once installed and effectively invisible to most users.

By introducing mandatory App Store review of all extensions, Apple could then analyze the in-page JavaScript code to ensure that it does not perform malicious actions. This explicitly protects against advertising and tracking attacks: any that escape initial analysis will be reported by users and security researchers. As we’ve seen on iOS, when someone finds an attack vector in one app, Apple can find and destroy all apps that exercise that vector. They would now be able to do the same with any malicious extensions that somehow survive the App Store review process.

As an end-user, I’m very glad to see this. I sympathize with uBlock users, but ultimately I do not want unreviewed code in my browser. I am not qualified to evaluate whether an extension’s latest update is safe or malware-infected, when a single compromised release could be used to spy on that userbase.

To those who would attack Apple for requiring extensions to go through review, keep in mind that Apple didn’t invent this review-required approach, and I believe they aren’t the first to market with it either.

To those who believe that sandboxing and reviews are morally unacceptable, I respect your position but ultimately disagree with it. Protecting me from coin mining and tracking and credentials theft attacks is more important to me than having the freedom to easily run arbitrary code in extensions. It’s still possible, but it requires Xcode to be installed and operated regularly.

I feel safer as a result of this change. Thank you, Apple.