Why Apple Mandates Notarization for Safari Extensions

This article explains why Apple requires all Safari web browser extensions to be either notarized or distributed directly through the Apple App Store. By enforcing these strict distribution pathways, Apple aims to protect users from malware, safeguard personal data privacy, maintain browser performance, and ensure developer accountability across its operating systems.

Malware Prevention and Security

The primary reason for requiring notarization and App Store distribution is security. When a developer distributes a Safari extension outside of the App Store, it must be bundled inside a macOS app and sent to Apple for notarization. This is an automated process that scans the software for malicious content and code-signing issues. If no malware is found, Apple issues a cryptographic ticket that tells macOS the software is safe to run.

Extensions distributed directly through the App Store undergo an even stricter review process, combining automated scans with human evaluation. Both methods drastically reduce the risk of users accidentally installing adware, spyware, or browser hijackers disguised as helpful tools.

Safeguarding User Privacy

Browser extensions often require high-level permissions to function, such as the ability to read and modify data on every webpage a user visits. In an unregulated environment, malicious extensions can easily harvest browsing history, steal passwords, or capture credit card information.

By requiring extensions to pass through Apple’s gatekeepers, Apple forces developers to adhere to strict privacy guidelines. Modern Safari extensions must use specific APIs that utilize "sandboxing." Sandboxing restricts the extension to a isolated environment, preventing it from accessing the broader operating system or user data that is not explicitly permitted.

Developer Accountability and Revocation

To get an extension notarized or published on the App Store, a developer must enroll in the Apple Developer Program, which requires identity verification and an annual fee. This creates a layer of accountability, as bad actors cannot easily remain anonymous.

Every approved extension is cryptographically signed with an Apple-issued certificate. If an extension passes the initial checks but is later discovered to be acting maliciously or violating user privacy, Apple has a built-in kill switch. Apple can revoke the developer's certificate, which immediately disables the rogue extension on all Mac, iPhone, and iPad devices worldwide.

Browser Performance and Battery Life

Historically, poorly coded browser extensions were a leading cause of browser crashes, slowdowns, and rapid battery drain. By forcing all extensions through its ecosystem, Apple deprecated legacy extension formats and mandated the use of modern Safari App Extensions and WebExtensions.

These modern frameworks are tightly integrated with macOS and iOS. They only run when actively needed rather than constantly consuming system resources in the background. Requiring App Store review or notarization ensures that developers are strictly using these modern, energy-efficient frameworks, resulting in a faster and more reliable browsing experience for the end user.