How Safari Prompts Users for External Apple Events

This article explains how the Safari web browser security model interacts with macOS to protect user privacy when external applications attempt to read or control open browser tabs using Apple Events. It covers the role of the macOS Transparency, Consent, and Control (TCC) framework, the specific permission prompts presented to the user, how these choices are managed, and the secondary security layer Safari uses to block unauthorized JavaScript execution.

The Role of Apple Events and TCC

Apple Events is the inter-process communication mechanism in macOS that allows applications to send commands and request data from one another, commonly used via AppleScript or JavaScript for Automation (JXA). Safari includes a scripting dictionary that allows external processes to query open windows, read the URLs and titles of active tabs, and manipulate browser state.

Because open browser tabs often contain sensitive personal information, session tokens, and private data, Safari does not allow external applications to freely access this information. Instead, Safari relies on the macOS Transparency, Consent, and Control (TCC) subsystem to mediate all incoming Apple Events.

The Initial User Prompt

When an external application—such as a launcher, a productivity tool, or a custom script—sends an Apple Event to Safari for the first time to read or control a tab, the following sequence occurs:

  1. Interception: The macOS TCC daemon intercepts the Apple Event before Safari can process the command.
  2. Suspension: The requesting application's command is paused while the system checks its internal database to see if the application already has permission to automate Safari.
  3. The Prompt: If no prior permission exists, the system displays a mandatory, system-level modal alert on the screen.

The prompt explicitly names the requesting application and states: "[Application Name]" wants access to control "Safari". Allowing control will provide access to documents and data in "Safari", and to perform actions within that app.

The user is presented with two options: Don't Allow and OK (or Allow in newer macOS versions).

What Happens After the Prompt

  • If the user selects Allow/OK: The TCC database records the approval, the paused Apple Event is delivered to Safari, and the external application immediately receives the tab data or executes the tab control command. Future Apple Events from that specific application to Safari will execute silently without triggering additional prompts.
  • If the user selects Don't Allow: macOS blocks the Apple Event and returns an error (errAEEventNotPermitted, error code -1743) to the requesting application. The external application cannot read or control Safari's tabs, and the system will not prompt the user again for that specific application.

Users can manually review, revoke, or enable these permissions at any time by navigating to System Settings > Privacy & Security > Automation, finding the requesting application, and toggling the switch next to Safari.

Secondary Prompt: JavaScript Execution

Granting an external application permission to control Safari via the standard TCC prompt allows it to read tab URLs, read tab titles, open new tabs, and close existing tabs. However, Safari enforces an additional security barrier if the external application attempts to use Apple Events to read the actual webpage content (the DOM) or execute JavaScript inside an open tab.

By default, Safari completely blocks JavaScript execution via Apple Events, even if the user clicked "Allow" on the system Automation prompt. If an application attempts this, Safari rejects the command.

To permit this level of control, the user must manually bypass Safari's secondary defense:

  1. Open Safari Settings, go to the Advanced tab, and check Show features for web developers (or Show Develop menu in menu bar).
  2. Click the Develop menu in the top menu bar and select Allow JavaScript from Apple Events (found under the Developer Settings submenu in newer versions).
  3. The Authentication Prompt: Selecting this option triggers a strict authentication prompt requiring the user to enter their macOS administrator password or use Touch ID to confirm the change.

Only after passing both the macOS TCC Automation prompt and the Safari-specific administrator password prompt can an external application fully read and manipulate the contents of open Safari tabs.