both the iOS 26.6.1 and iOS 18.7.10 updates patch serious issues in WebKit, the engine that underpins Apple’s Safari browser. They land nearly three weeks after iOS 26.6 patched 90 issues. No iOS 18 update was released at the time.
With everybody on Webkit, a vulnerability in it applies to every browser and nearly all apps on iOS. If other engines were allowed, a threat would only apply to apps using that engine.
On the flip side, keeping the engine centralized means that a single fix will close a hole in every app, keeping unmaintained apps safer.
I wonder if it would be possible to implement Firefox or Chromium in webassembly and run it on top of WebKit — it wouldn’t be as performant, but would be an extra layer of sandbox. You could theoretically do this in any app that uses WebKit too.
“The iOS 26.6.1 update fixes three flaws in the iPhone Kernel and nearly 20 in WebKit.”
It wouldn’t be, if Apple would allow other browsers to use their own rendering engines.
It’s true… it’d be replaced by a much LARGER attack surface.
With everybody on Webkit, a vulnerability in it applies to every browser and nearly all apps on iOS. If other engines were allowed, a threat would only apply to apps using that engine.
On the flip side, keeping the engine centralized means that a single fix will close a hole in every app, keeping unmaintained apps safer.
I wonder if it would be possible to implement Firefox or Chromium in webassembly and run it on top of WebKit — it wouldn’t be as performant, but would be an extra layer of sandbox. You could theoretically do this in any app that uses WebKit too.