Safari Web Features Disabled in Apple's Lockdown Mode

This article provides a comprehensive breakdown of the specific web technologies and features that are disabled in the Safari browser when Apple's Lockdown Mode is activated. Designed for individuals facing sophisticated cyber threats, Lockdown Mode significantly shrinks the browser's attack surface by turning off complex rendering engines, advanced scripting capabilities, and media APIs. Below is a direct look at the exact functionalities—ranging from Just-In-Time JavaScript compilation to custom web fonts—that are restricted to maximize device security.

Just-In-Time (JIT) JavaScript Compilation

In standard browsing, Safari uses a Just-In-Time (JIT) compiler to translate JavaScript into machine code for fast execution. Because JIT compilation requires writable and executable memory, it is a prime target for spyware exploits. Lockdown Mode disables the JIT compiler entirely. JavaScript still functions using a safer, slower interpreter, which may cause code-heavy websites to run noticeably slower.

WebAssembly (Wasm)

WebAssembly allows developers to run high-performance code (like C++ or Rust) directly in the browser. Because it operates close to the system hardware and relies on complex compilation pipelines, Safari completely disables WebAssembly in Lockdown Mode. Web applications relying on Wasm for heavy tasks, such as browser-based video editors, will not function.

WebGL and 3D Graphics

WebGL allows websites to render interactive 2D and 3D graphics by communicating directly with the device’s Graphics Processing Unit (GPU). To prevent attackers from exploiting vulnerabilities in graphics drivers, WebGL is turned off. Any website element that relies on 3D rendering or hardware-accelerated canvas features will fail to load.

Custom Web Fonts

Parsing complex font files is a historically common method for attackers to execute malicious code on a device. Lockdown Mode blocks Safari from downloading and rendering custom web fonts. Instead, the browser forces websites to use built-in system fonts. Because icon packs are often delivered as custom fonts, many websites will display missing icons or blank boxes in place of buttons.

Complex Image Formats

Image parsers are another frequent target for zero-click exploits. When Lockdown Mode is enabled, Safari restricts the rendering of certain complex image formats, most notably Scalable Vector Graphics (SVG). As a result, some images, logos, and vector-based animations will not appear on web pages.

WebRTC (Web Real-Time Communication)

WebRTC enables peer-to-peer audio, video, and data sharing directly between browsers without plugins. Because it requires deep access to media processing engines and network interfaces, Safari disables WebRTC in Lockdown Mode. Browser-based video conferencing and voice call tools will not work.

Service Workers and Background Tasks

Service workers are scripts that run in the background of a browser, separate from a web page, enabling features like offline functionality and push notifications. Lockdown Mode disables service workers to ensure that websites cannot persistently run code in the background or cache potentially malicious payloads.

Media and Hardware Access APIs

To further reduce the available attack surface, Safari disables several programming interfaces that interact with device hardware and complex media processing:

  • Web Audio API: Advanced audio processing and synthesis capabilities are turned off.
  • Web Speech API: Voice recognition and text-to-speech features within web pages are blocked.
  • Gamepad API: Websites cannot detect or accept input from connected gaming controllers.
  • MediaStream API: Direct access to the device's camera and microphone through the browser is heavily restricted or blocked.

MathML

Mathematical Markup Language (MathML) is used to display complex mathematical equations on web pages. Because its rendering requires specialized, complex layout code in the browser engine, MathML is disabled to eliminate potential parsing vulnerabilities.

File and Data Handling

Safari also restricts how websites can interact with local files and data streams. The File System Access API and IndexedDB (in certain contexts) are restricted, preventing websites from storing large amounts of structured data on the device or requesting direct read/write access to local directories.