Bug 282632 – Advanced tracking and fingerprinting treats extension content scripts as 3rd party trackers

• Status: REOPENED
• Component: WebKit Extensions

[Jeff Johnson]

Created attachment 473146 [details]
Sample Xcode project

Steps to reproduce:
1) Download, build, run, and enable the attached Safari extension TrackingBug in Safari
2) Allow Tracking Bug in private browsing
3) Enable advanced tracking and fingerprinting protection in private browsing
4) Open https://lapcatsoftware.com/articles/2024/6/5.html in Safari
5) Click the link https://underpassapp.com/test/gtag.html?q=search

Expected results:
The content script shows an alert on the page identifying window.location.search as "?q=search".

Actual results:
The content script shows an alert on the page that identifying window.location.search as "".

Advanced tracking and fingerprinting protection is treating the Safari extension content script as a third-party tracker on the page, thereby restricting its access to the URL query.

This bug breaks several features of my Safari extension StopTheMadness Pro, such as copying the page URL and removing parameters from the page URL.

[Radar WebKit Bug Importer]

<rdar://problem/139305676>

[Timothy Hatcher]

I am unable to reproduce this in Safari 26.

[Jeff Johnson]

(In reply to Timothy Hatcher from comment #2)
> I am unable to reproduce this in Safari 26.

I can still reproduce in Safari 26 on macOS Tahoe.

Can you take a screenshot after step 5?

Created attachment 476616 [details]
window.location.srarch doesnt update and login doesnt work

Hi!

I have attached the video of the bug above.

This is affecting us as well. I work for a company called ComeOn Group and we show our login form inside a "sidebar menu" and we open it on window.location change like below - 


https://www.888.nl/nl/?sidebar=login 

when the url has ?sidebar=login, it triggers the login page.


With advanced tracking protection enabled on Safari, we are no longer able to read the window.location.search as it returns "" instead of "?sidebar=login". We have many more pages with "?sidebar=xxx" pattern and all of those are broken.

I understand the intention to block tracking params, but its also affecting non-tracking params such as the one I mentioned above and its causing our app to non-functional.

Can you advice what we should do to fix this? 

Context: 

FYI - we serve our JS files from a CDN and the CDN url domain is not the same as that of the page.

Page url - https://www.888.nl/nl

Our JS CDN url - https://d3eg6wi5fpm57g.cloudfront.net

Is this also causing the above problem? Would having the scripts served from same domain fix the issue?

[Jeff Johnson]

(In reply to kulur.harish from comment #5)
> Hi!
> 
> I have attached the video of the bug above.
> 
> This is affecting us as well. I work for a company called ComeOn Group and
> we show our login form inside a "sidebar menu" and we open it on
> window.location change like below - 
> 
> 
> https://www.888.nl/nl/?sidebar=login 
> 
> when the url has ?sidebar=login, it triggers the login page.
> 
> 
> With advanced tracking protection enabled on Safari, we are no longer able
> to read the window.location.search as it returns "" instead of
> "?sidebar=login". We have many more pages with "?sidebar=xxx" pattern and
> all of those are broken.
> 
> I understand the intention to block tracking params, but its also affecting
> non-tracking params such as the one I mentioned above and its causing our
> app to non-functional.
> 
> Can you advice what we should do to fix this? 
> 
> Context: 
> 
> FYI - we serve our JS files from a CDN and the CDN url domain is not the
> same as that of the page.
> 
> Page url - https://www.888.nl/nl
> 
> Our JS CDN url - https://d3eg6wi5fpm57g.cloudfront.net
> 
> Is this also causing the above problem? Would having the scripts served from
> same domain fix the issue?

This bug is about Safari extensions. Your report does not appear to be a Safari extensions issue. Please file a separate WebKit bug for your issue.

[Jeff Johnson]

(In reply to Jeff Johnson from comment #0)
> Created attachment 473146 [details]
> Sample Xcode project
> 
> Steps to reproduce:
> 1) Download, build, run, and enable the attached Safari extension
> TrackingBug in Safari
> 2) Allow Tracking Bug in private browsing
> 3) Enable advanced tracking and fingerprinting protection in private browsing
> 4) Open https://lapcatsoftware.com/articles/2024/6/5.html in Safari
> 5) Click the link https://underpassapp.com/test/gtag.html?q=search
> 
> Expected results:
> The content script shows an alert on the page identifying
> window.location.search as "?q=search".
> 
> Actual results:
> The content script shows an alert on the page that identifying
> window.location.search as "".
> 
> Advanced tracking and fingerprinting protection is treating the Safari
> extension content script as a third-party tracker on the page, thereby
> restricting its access to the URL query.
> 
> This bug breaks several features of my Safari extension StopTheMadness Pro,
> such as copying the page URL and removing parameters from the page URL.

I can still reproduce this in Safari 26 and Safari Technology Preview.

To clarify my steps to reproduce:
4) Open https://lapcatsoftware.com/articles/2024/6/5.html in a Safari private window
5) Click the link https://underpassapp.com/test/gtag.html?q=search in the blog post from step 4

Apparently Safari 26 enables advanced tracking and fingerprinting by default in private and non-private windows, so this is going to become a major problem for me soon. If this bug isn't fixed, I'm going to have to publicly advise my customers to disable the feature in Safari.

[Wenson Hsieh]

> Apparently Safari 26 enables advanced tracking and fingerprinting by default in private and non-private windows, so this is going to become a major problem for me soon. If this bug isn't fixed, I'm going to have to publicly advise my customers to disable the feature in Safari.

This protection applies only to a subset of scripts — I've confirmed that this bug does not reproduce in normal browsing in Safari 26, with these protections enabled.

(That said, the original issue in private browsing mode, or with Advanced Tracking/Fingerprinting protections enabled, still reproduces).

[Jeff Johnson]

(In reply to Wenson Hsieh from comment #8)
> > Apparently Safari 26 enables advanced tracking and fingerprinting by default in private and non-private windows, so this is going to become a major problem for me soon. If this bug isn't fixed, I'm going to have to publicly advise my customers to disable the feature in Safari.
> 
> This protection applies only to a subset of scripts — I've confirmed that
> this bug does not reproduce in normal browsing in Safari 26, with these
> protections enabled.

Which protections? I've assumed that these are referring to the "Use advanced tracking and fingerprinting protection" setting in Safari, but maybe not?

"Safari now offers advanced fingerprinting protection in all browsing by default." https://www.apple.com/newsroom/2025/06/macos-tahoe-26-makes-the-mac-more-capable-productive-and-intelligent-than-ever/

"Browsing in Safari gets even more private with advanced fingerprinting protection extending to all browsing by default." https://www.apple.com/newsroom/2025/06/apple-elevates-the-iphone-experience-with-ios-26/

> (That said, the original issue in private browsing mode, or with Advanced
> Tracking/Fingerprinting protections enabled, still reproduces).

What do you mean by "or with Advanced Tracking/Fingerprinting protections enabled"? Do you mean enabled in all browsing, as opposed to just in private browsing?

So you can indeed reproduce my reported bug? It was closed earlier as "unable to reproduce".

[Wenson Hsieh]

> Which protections? I've assumed that these are referring to the "Use advanced tracking and fingerprinting protection" setting in Safari, but maybe not?

I am referring to protections that are new in Safari 26, which are *not* guarded by the "Use advanced tracking and fingerprinting protection" setting. Instead, these new protections are a part of Intelligent Tracking Prevention, and are thus guarded by "Prevent cross-site tracking" in Safari's privacy settings.

> What do you mean by "or with Advanced Tracking/Fingerprinting protections enabled"? Do you mean enabled in all browsing, as opposed to just in private browsing?
> So you can indeed reproduce my reported bug? It was closed earlier as "unable to reproduce".

I can indeed reproduce your bug (using the TrackingBug extension) in Private Browsing mode in Safari 26. I confirmed that it does *not* reproduce in normal browsing in Safari 26 by default.

[Jeff Johnson]

(In reply to Wenson Hsieh from comment #10)
> > Which protections? I've assumed that these are referring to the "Use advanced tracking and fingerprinting protection" setting in Safari, but maybe not?
> 
> I am referring to protections that are new in Safari 26, which are *not*
> guarded by the "Use advanced tracking and fingerprinting protection"
> setting. Instead, these new protections are a part of Intelligent Tracking
> Prevention, and are thus guarded by "Prevent cross-site tracking" in
> Safari's privacy settings.

Ah, ok, thanks for the clarification!

> > What do you mean by "or with Advanced Tracking/Fingerprinting protections enabled"? Do you mean enabled in all browsing, as opposed to just in private browsing?
> > So you can indeed reproduce my reported bug? It was closed earlier as "unable to reproduce".
> 
> I can indeed reproduce your bug (using the TrackingBug extension) in Private
> Browsing mode in Safari 26. I confirmed that it does *not* reproduce in
> normal browsing in Safari 26 by default.

Thanks!