OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add dpearson2699/swift-ios-skills --skill browserenginekit
Build alternative browser engines using BrowserEngineKit. Use when developing a non-WebKit browser engine for iOS/iPadOS in supported regions, managing web content/rendering/networking extension processes, configuring GPU and networking process capabilities, checking alternative-engine device eligibility, or reviewing BrowserEngineKit entitlements and Info.plist setup.
npx skills add dpearson2699/swift-ios-skills --skill browserenginekit
Framework for building web browsers with alternative (non-WebKit) rendering engines on iOS and iPadOS. Provides process isolation, XPC communication, capability management, and system integration for browser apps that implement their own HTML/CSS/JavaScript engine. Examples target Swift 6.3 and current Apple SDKs.
BrowserEngineKit is a specialized framework. Alternative browser engines are available only through Apple-approved entitlement profiles and supported-region device eligibility. EU support applies to eligible users on iOS 17.4+ and iPadOS 18+; Japan support starts with iOS 26.2 and adds explicit PAC/MIE security requirements for browser apps. Development and testing can occur anywhere. The companion frameworks BrowserEngineCore (low-level primitives) and BrowserKit (eligibility checks, data transfer) support the overall workflow.
Use BEAvailability from the BrowserKit framework to check whether the device
is eligible for alternative browser engines. BEAvailability is available on
iOS/iPadOS 18.4+:
Eligibility depends on the device region and OS version. Do not hard-code region checks; rely on the system API.
Availability anchors: process APIs are iOS/iPadOS 17.4+, BEDownloadMonitor
is iOS 18.2+, .revision2 restricted sandbox is iOS 26+, and
RenderingExtensionFeature.coreML is iOS 26.2+.
The host app requires two entitlements:
| Entitlement | Purpose |
|---|---|
com.apple.developer.web-browser | Enables default-browser candidacy |
com.apple.developer.web-browser-engine.host | Enables alternative engine extensions |
Both must be requested from Apple. The request process varies by region.
Each extension target requires its type-specific entitlement set to true:
| Extension Type | Entitlement |
|---|---|
| Web content | com.apple.developer.web-browser-engine.webcontent |
| Networking | com.apple.developer.web-browser-engine.networking |
| Rendering | com.apple.developer.web-browser-engine.rendering |
| Entitlement | Extension | Purpose |
|---|---|---|
com.apple.security.cs.allow-jit | Web content | JIT compilation of scripts |
com.apple.developer.kernel.extended-virtual-addressing | Web content | Required alongside JIT |
com.apple.developer.memory.transfer_send | Rendering | Send memory attribution; value is host app bundle ID |
com.apple.developer.memory.transfer_accept | Web content | Accept memory attribution; value is host app bundle ID |
com.apple.developer.web-browser-engine.restrict.notifyd | Web content | Restrict notification daemon access |
Apps that are not browsers but embed an alternative engine for in-app browsing use different entitlements:
| Entitlement | Purpose |
|---|---|
com.apple.developer.embedded-web-browser-engine | Enable embedded engine |
com.apple.developer.embedded-web-browser-engine.engine-association | Declare engine ownership |
engine-association is available starting iOS/iPadOS/Mac Catalyst 26.2 and is
set to first-party when you own the engine or third-party when another
developer owns it. Embedded engines use arm64 only (not arm64e), cannot
include browser extensions, and cannot use JIT compilation.
Browser apps distributed in Japan are supported on iOS 26.2+ and must adopt the
current security mitigations Apple lists for Japan, including Pointer
Authentication Codes and Memory Integrity Enforcement for relevant allocators
and extension processes. Enable hardware memory tagging with
com.apple.security.hardened-process.checked-allocations; Apple strongly
recommends enabling it in the EU as well.
A browser built with BrowserEngineKit consists of four components running in separate processes:
The host app launches and manages all extensions. Extensions cannot launch other extensions. Extensions communicate with each other through anonymous XPC endpoints brokered by the host app.
This architecture follows the principle of least privilege: the web content extension works with untrusted data but has no direct OS resource access.
Each extension type has a corresponding process class in the host app:
Pass nil for bundleIdentifier to use the default extension target. The
interruption handler fires if the extension crashes or is terminated by the OS.
Each process type provides makeLibXPCConnection() to create an
xpc_connection_t for communication.
After calling invalidate(), no further method calls on the process object
are valid.
Hosts the browser engine's HTML parser, CSS engine, JavaScript interpreter,
and DOM. Conform to WebContentExtension to handle incoming XPC connections:
Configure via WebContentExtensionConfiguration in the extension's
EXAppExtensionAttributes.
Handles all network requests using URLSession or socket APIs. One instance
serves all tabs:
Configure via NetworkingExtensionConfiguration.
Accesses the GPU via Metal for video decoding, compositing, and complex rendering. One instance typically serves the entire browser:
Configure via RenderingExtensionConfiguration.
Grant capabilities to extensions so the OS schedules them appropriately:
| Capability | Use Case |
|---|---|
.foreground | Active tab rendering, visible content |
.background | Background tasks, prefetching |
.suspended | Minimal activity, pending cleanup |
.mediaPlaybackAndCapture(environment:) | Audio/video playback, camera/mic capture |
For media capabilities, create a MediaEnvironment tied to a page URL.
The environment supports AVCaptureSession for camera/mic access and is
XPC-serializable for cross-process transport:
Attach a visibility propagation interaction to browser views so extensions
know when content is on screen. Both WebContentProcess and
RenderingProcess provide createVisibilityPropagationInteraction().
The rendering extension draws into a LayerHierarchy, whose content the
host app displays via LayerHierarchyHostingView. Handles are passed over
XPC. Use LayerHierarchyHostingTransactionCoordinator to synchronize layer
updates atomically across processes.
See references/browserenginekit-patterns.md for detailed layer hosting examples and transaction coordination.
Adopt BETextInput on custom text views to integrate with UIKit's text
system. This enables standard text selection, autocorrect, dictation, and
keyboard interactions.
Key integration points:
asyncInputDelegate for communicating text changes to the systemhandleKeyEntry(_:completionHandler:) for keyboard eventsBETextInteraction for selection gestures, edit menus, and context menusBEScrollView and BEScrollViewDelegate for custom scroll handlingSee references/browserenginekit-patterns.md for detailed text interaction implementation.
After initialization, lock down content extensions using the restricted sandbox:
This removes access to resources the extension used during startup but no longer needs. Use the latest available revision for the strongest restrictions.
Web content extensions that JIT-compile JavaScript must transition pages with BrowserEngineKit's witnessed APIs:
Requires the com.apple.security.cs.allow-jit and
com.apple.developer.kernel.extended-virtual-addressing entitlements on
the web content extension only. If an implementation instead uses pthread_jit_write_with_callback_np, it also needs the JIT write allowlist entitlement; do not present BE_JIT_WRITE_PROTECT_TAG alone as a complete protection strategy.
Distribution builds must satisfy the current alternative-browser entitlement profile's device architecture, PAC, and MIE requirements. Keep the host and extension configuration consistent, include the required device slices, and test the signed archive on eligible devices. Embedded engines differ: they are arm64-only and cannot use JIT. Do not force arm64e onto Simulator builds or copy a one-line ARCHS override that drops required slices.
Report download progress to the system using BEDownloadMonitor. Create an
access token, initialize the monitor with source/destination URLs and a
Progress object, then call beginMonitoring() to show the system download
UI. Use resumeMonitoring(placeholderURL:) to resume interrupted downloads.
BEDownloadMonitor is available on iOS 18.2+.
See references/browserenginekit-patterns.md for full download management examples.
JIT compilation entitlements (com.apple.security.cs.allow-jit) are valid
only on web content extensions. Adding them to the host app, rendering
extension, or networking extension causes App Store rejection.
Without web-browser-engine in UIRequiredDeviceCapabilities, users on
unsupported devices can download the app and hit runtime failures.
com.apple.developer.web-browser-engine.host entitlement on host appUIRequiredDeviceCapabilities includes web-browser-enginearm64e instruction set configured for all iOS device targetsarm64e is not set for Simulator targetsiOSPackagesShouldBuildARM64e workspace settingBEAvailability used for eligibility checks instead of manual region logicBEDownloadMonitor for active downloads on iOS 18.2+Host App (UI, coordination)
|
|-- XPC --> Web Content Extension (HTML parsing, JS, DOM)
|-- XPC --> Networking Extension (URLSession, sockets)
|-- XPC --> Rendering Extension (Metal, GPU, media)import BrowserEngineKit
// Web content (one per tab or iframe)
let contentProcess = try await WebContentProcess(
bundleIdentifier: nil,
onInterruption: {
// Handle crash or OS interruption
}
)
// Networking (typically one instance)
let networkProcess = try await NetworkingProcess(
bundleIdentifier: nil,
onInterruption: {
// Handle interruption
}
)
// Rendering / GPU (typically one instance)
let renderingProcess = try await RenderingProcess(
bundleIdentifier: nil,
onInterruption: {
// Handle interruption
}
)let connection = try contentProcess.makeLibXPCConnection()
// Use connection for inter-process messagingcontentProcess.invalidate()import BrowserEngineKit
@main
struct MyWebContentExtension: WebContentExtension {
func handle(xpcConnection: xpc_connection_t) {
// Set up message handlers on the connection
}
}import BrowserEngineKit
@main
struct MyNetworkingExtension: NetworkingExtension {
func handle(xpcConnection: xpc_connection_t) {
// Handle network request messages
}
}import BrowserEngineKit
@main
struct MyRenderingExtension: RenderingExtension {
init() {
if #available(iOS 26.2, macOS 26.2, *) {
enableFeature(.coreML)
}
}
func handle(xpcConnection: xpc_connection_t) {
// Handle rendering commands
}
}// Grant foreground priority to an extension
let grant = try contentProcess.grantCapability(.foreground)
// ... extension does foreground work ...
// Relinquish when done
grant.invalidate()let mediaEnv = MediaEnvironment(webPage: pageURL)
let grant = try contentProcess.grantCapability(
.mediaPlaybackAndCapture(environment: mediaEnv)
)
try mediaEnv.activate()
let captureSession = try mediaEnv.makeCaptureSession()// In the web content extension, after setup:
if #available(iOS 26.0, macOS 26.0, *) {
applyRestrictedSandbox(revision: .revision2)
} else {
applyRestrictedSandbox(revision: .revision1)
}import BrowserEngineCore
be_memory_inline_jit_restrict_rwx_to_rw_with_witness(...)
// write generated code
be_memory_inline_jit_restrict_rwx_to_rx_with_witness(...)// WRONG - content extension has no path to other extensions
let contentProcess = try await WebContentProcess(
bundleIdentifier: nil, onInterruption: {}
)
// Immediately start sending work without connecting to networking/rendering
// CORRECT - broker connections through the host app
let networkEndpoint = try await networkProxy.getEndpoint()
let renderEndpoint = try await renderProxy.getEndpoint()
try await contentProxy.bootstrap(
renderingExtension: renderEndpoint,
networkExtension: networkEndpoint
)// WRONG - extensions cannot launch other extensions
// (inside a WebContentExtension)
let network = try await NetworkingProcess(...)
// CORRECT - only the host app launches extensions
// Host app creates all processes, then brokers connections// WRONG
contentProcess.invalidate()
let conn = try contentProcess.makeLibXPCConnection() // Error
// CORRECT - create a new process if needed
let newProcess = try await WebContentProcess(
bundleIdentifier: nil, onInterruption: {}
)// WRONG
if Locale.current.region?.identifier == "DE" {
useAlternativeEngine()
}
// CORRECT - use the system eligibility API
let eligible = try await BEAvailability.isEligible(for: .webBrowser)
if eligible {
useAlternativeEngine()
}