BrowserEngineKit
Framework for building web browsers with alternative (non-WebKit) rendering
engines on iOS and iPadOS. Provides process isolation, XPC communication,
capability management, and system integration for browser apps that implement
their own HTML/CSS/JavaScript engine. Targets Swift 6.3 / iOS 26+.
BrowserEngineKit is a specialized framework. Alternative browser engines are
currently supported for distribution in the EU. Japan requires Memory Integrity
Enforcement (MIE) for alternative browser engine distribution. Development and
testing can occur anywhere. The companion
frameworks BrowserEngineCore (low-level primitives) and BrowserKit (eligibility
checks, data transfer) support the overall browser engine workflow.
Contents
Overview and Eligibility
Eligibility Checking
Use
from the BrowserKit framework to check whether the device
is eligible for alternative browser engines:
swift
import BrowserKit
BEAvailability.isEligible(for: .webBrowser) { eligible, error in
if eligible {
// Device supports alternative browser engines
} else {
// Fall back or show explanation
}
}
Eligibility depends on the device region and OS version. Do not hard-code
region checks; rely on the system API.
Related Frameworks
| Framework | Purpose |
|---|
| BrowserEngineKit | Process management, extensions, text/view integration |
| BrowserEngineCore | Low-level primitives: kernel events, JIT tag, audio session |
| BrowserKit | Eligibility checks, browser data import/export |
Entitlements
Browser App (Host)
The host app requires two entitlements:
| Entitlement | Purpose |
|---|
com.apple.developer.web-browser
| Enables default-browser candidacy |
com.apple.developer.web-browser-engine.host
| Enables alternative engine extensions |
Both must be requested from Apple. The request process varies by region.
Extension Entitlements
Each extension target requires its type-specific entitlement set to
:
| Extension Type | Entitlement |
|---|
| Web content | com.apple.developer.web-browser-engine.webcontent
|
| Networking | com.apple.developer.web-browser-engine.networking
|
| Rendering | com.apple.developer.web-browser-engine.rendering
|
Optional Entitlements
| Entitlement | Extension | Purpose |
|---|
com.apple.security.cs.allow-jit
| Web content | JIT compilation of scripts |
com.apple.developer.kernel.extended-virtual-addressing
| Web content | Required alongside JIT |
com.apple.developer.memory.transfer_send
| Rendering | Send memory attribution |
com.apple.developer.memory.transfer_accept
| Web content | Accept memory attribution |
com.apple.developer.web-browser-engine.restrict.notifyd
| Web content | Restrict notification daemon access |
Embedded Browser Engine (Non-Browser Apps)
Apps that are not browsers but embed an alternative engine for in-app browsing
use different entitlements:
| Entitlement | Purpose |
|---|
com.apple.developer.embedded-web-browser-engine
| Enable embedded engine |
com.apple.developer.embedded-web-browser-engine.engine-association
| Declare engine ownership |
Embedded engines use
only (not
), cannot include browser
extensions, and cannot use JIT compilation.
Japan-Specific Requirements
Browser apps distributed in Japan must enable hardware memory tagging via
com.apple.security.hardened-process.checked-allocations
. Apple strongly
recommends enabling this in the EU as well.
Architecture
A browser built with BrowserEngineKit consists of four components running in
separate processes:
Host App (UI, coordination)
|
|-- XPC --> Web Content Extension (HTML parsing, JS, DOM)
|-- XPC --> Networking Extension (URLSession, sockets)
|-- XPC --> Rendering Extension (Metal, GPU, media)
The host app launches and manages all extensions. Extensions cannot launch
other extensions. Extensions communicate with each other through anonymous XPC
endpoints brokered by the host app.
Bootstrap Sequence
- Host launches web content, networking, and rendering extensions
- Host creates XPC connections to each extension
- Host requests anonymous XPC endpoints from networking and rendering
- Host sends both endpoints to the web content extension via a bootstrap
message
- Web content extension connects directly to networking and rendering
This architecture follows the principle of least privilege: the web content
extension works with untrusted data but has no direct OS resource access.
Process Management
Launching Extensions
Each extension type has a corresponding process class in the host app:
swift
import BrowserEngineKit
// Web content (one per tab or iframe)
let contentProcess = try await WebContentProcess(
bundleIdentifier: nil,
onInterruption: {
// Handle crash or OS interruption
}
)
// Networking (typically one instance)
let networkProcess = try await NetworkingProcess(
bundleIdentifier: nil,
onInterruption: {
// Handle interruption
}
)
// Rendering / GPU (typically one instance)
let renderingProcess = try await RenderingProcess(
bundleIdentifier: nil,
onInterruption: {
// Handle interruption
}
)
Pass
for
to use the default extension target. The
interruption handler fires if the extension crashes or is terminated by the OS.
Creating XPC Connections
swift
let connection = try contentProcess.makeLibXPCConnection()
// Use connection for inter-process messaging
Each process type provides
to create an
for communication.
Stopping Extensions
swift
contentProcess.invalidate()
After calling
, no further method calls on the process object
are valid.
Extension Types
Web Content Extension
Hosts the browser engine's HTML parser, CSS engine, JavaScript interpreter,
and DOM. Subclass
to handle incoming XPC connections:
swift
import BrowserEngineKit
final class MyWebContentExtension: WebContentExtension {
override func handle(xpcConnection: xpc_connection_t) {
// Set up message handlers on the connection
}
}
Configure via
WebContentExtensionConfiguration
in the extension's
.
Networking Extension
Handles all network requests using
or socket APIs. One instance
serves all tabs:
swift
import BrowserEngineKit
final class MyNetworkingExtension: NetworkingExtension {
override func handle(xpcConnection: xpc_connection_t) {
// Handle network request messages
}
}
Configure via
NetworkingExtensionConfiguration
.
Rendering Extension
Accesses the GPU via Metal for video decoding, compositing, and complex
rendering. One instance typically serves the entire browser:
swift
import BrowserEngineKit
final class MyRenderingExtension: RenderingExtension {
override func handle(xpcConnection: xpc_connection_t) {
// Handle rendering commands
}
}
The rendering extension can enable optional features:
swift
// Enable CoreML in the rendering extension
extension.enableFeature(.coreML)
Configure via
RenderingExtensionConfiguration
.
Capabilities
Grant capabilities to extensions so the OS schedules them appropriately:
swift
// Grant foreground priority to an extension
let grant = try contentProcess.grantCapability(.foreground)
// ... extension does foreground work ...
// Relinquish when done
grant.invalidate()
Available Capabilities
| Capability | Use Case |
|---|
| Active tab rendering, visible content |
| Background tasks, prefetching |
| Minimal activity, pending cleanup |
.mediaPlaybackAndCapture(environment:)
| Audio/video playback, camera/mic capture |
Media Environment
For media capabilities, create a
tied to a page URL.
The environment supports
for camera/mic access and is
XPC-serializable for cross-process transport:
swift
let mediaEnv = MediaEnvironment(webPage: pageURL)
let grant = try contentProcess.grantCapability(
.mediaPlaybackAndCapture(environment: mediaEnv)
)
try mediaEnv.activate()
let captureSession = try mediaEnv.makeCaptureSession()
Visibility Propagation
Attach a visibility propagation interaction to browser views so extensions
know when content is on screen. Both
and
provide
createVisibilityPropagationInteraction()
.
Layer Hosting and View Coordination
The rendering extension draws into a
, whose content the
host app displays via
LayerHierarchyHostingView
. Handles are passed over
XPC. Use
LayerHierarchyHostingTransactionCoordinator
to synchronize layer
updates atomically across processes.
See references/browserenginekit-patterns.md for detailed layer hosting
examples and transaction coordination.
Text Interaction
Adopt
on custom text views to integrate with UIKit's text
system. This enables standard text selection, autocorrect, dictation, and
keyboard interactions.
Key integration points:
- for communicating text changes to the system
handleKeyEntry(_:completionHandler:)
for keyboard events
- for selection gestures, edit menus, and context menus
- and for custom scroll handling
See references/browserenginekit-patterns.md for detailed text interaction
implementation.
Sandbox and Security
Restricted Sandbox
After initialization, lock down content extensions using the restricted
sandbox:
swift
// In the web content extension, after setup:
extension.applyRestrictedSandbox(revision: .revision2)
This removes access to resources the extension used during startup but no
longer needs. Use the latest revision (
) for the strongest
restrictions.
JIT Compilation
Web content extensions that JIT-compile JavaScript toggle memory between
writable and executable states. Use the
from
BrowserEngineCore:
swift
import BrowserEngineCore
// BE_JIT_WRITE_PROTECT_TAG is used with pthread_jit_write_protect_np
// to control JIT memory page permissions
Requires the
com.apple.security.cs.allow-jit
and
com.apple.developer.kernel.extended-virtual-addressing
entitlements on
the web content extension only.
arm64e Requirement
All executables (host app and extensions) must be built with the
instruction set for distribution. Build as a universal binary to also support
iPads.
In Xcode build settings or xcconfig:
ARCHS[sdk=iphoneos*]=arm64e
Do not use
for Simulator targets.
Downloads
Report download progress to the system using
. Create an
access token, initialize the monitor with source/destination URLs and a
object, then call
to show the system download
UI. Use
resumeMonitoring(placeholderURL:)
to resume interrupted downloads.
See references/browserenginekit-patterns.md for full download management
examples.
Common Mistakes
DON'T: Skip the bootstrap sequence
swift
// WRONG - content extension has no path to other extensions
let contentProcess = try await WebContentProcess(
bundleIdentifier: nil, onInterruption: {}
)
// Immediately start sending work without connecting to networking/rendering
// CORRECT - broker connections through the host app
let networkEndpoint = try await networkProxy.getEndpoint()
let renderEndpoint = try await renderProxy.getEndpoint()
try await contentProxy.bootstrap(
renderingExtension: renderEndpoint,
networkExtension: networkEndpoint
)
DON'T: Launch extensions from other extensions
swift
// WRONG - extensions cannot launch other extensions
// (inside a WebContentExtension)
let network = try await NetworkingProcess(...)
// CORRECT - only the host app launches extensions
// Host app creates all processes, then brokers connections
DON'T: Use extension process objects after invalidation
swift
// WRONG
contentProcess.invalidate()
let conn = try contentProcess.makeLibXPCConnection() // Error
// CORRECT - create a new process if needed
let newProcess = try await WebContentProcess(
bundleIdentifier: nil, onInterruption: {}
)
DON'T: Apply JIT entitlements to non-content extensions
JIT compilation entitlements (
com.apple.security.cs.allow-jit
) are valid
only on web content extensions. Adding them to the host app, rendering
extension, or networking extension causes App Store rejection.
DON'T: Hard-code region eligibility
swift
// WRONG
if Locale.current.region?.identifier == "DE" {
useAlternativeEngine()
}
// CORRECT - use the system eligibility API
BEAvailability.isEligible(for: .webBrowser) { eligible, _ in
if eligible { useAlternativeEngine() }
}
DON'T: Forget to set UIRequiredDeviceCapabilities
Without
in
UIRequiredDeviceCapabilities
, users on
unsupported devices can download the app and hit runtime failures.
Review Checklist
References