Build alternative browser engines using BrowserEngineKit. Use when developing a non-WebKit browser engine for iOS/iPadOS in supported regions, managing web content/rendering/networking extension processes, configuring GPU and networking process capabilities, checking alternative-engine device eligib

BrowserEngineKit Framework for building web browsers with alternative (non WebKit) rendering engines on iOS and iPadOS. Provides process isolation, XPC communication, capability management, and system integration for browser apps that implement their own HTML/CSS/JavaScript engine. Examples target Swift 6.3 and current Apple SDKs. BrowserEngineKit is a specialized framework. Alternative browser engines are available only through Apple approved entitlement profiles and supported region device eligibility. EU support applies to eligible users on iOS 17.4+ and iPadOS 18+; Japan support starts with iOS 26.2 and adds explicit PAC/MIE security requirements for browser apps. Development and testing can occur anywhere. The companion frameworks BrowserEngineCore (low level primitives) and BrowserKit (eligibility checks, data transfer) support the overall workflow. Contents [Overview and Eligibility]( overview and eligibility) [Entitlements]( entitlements) [Architecture]( architecture) [Process Management]( process management) [Extension Types]( extension types) [Capabilities]( capabilities) [Layer Hosting and View Coordination]( layer hosting and view coordination) [Text Interaction]( text interaction) [Sandbox and Security]( sandbox and security) [Downloads]( downloads) [Common Mistakes]( common mistakes) [Review Checklist]( review checklist) [References]( references) Overview and Eligibility Eligibility Checking Use BEAvailability from the BrowserKit framework to check whether the device is eligible for alternative browser engines. BEAvailability is available on iOS/iPadOS 18.4+: Eligibility depends on the device region and OS version. Do not hard code region checks; rely on the system API. Availability anchors: process APIs are iOS/iPadOS 17.4+, BEDownloadMonitor is iOS 18.2+, .revision2 restricted sandbox is iOS 26+, and RenderingExtensionFeature.coreML is iOS 26.2+. Entitlements Browser App (Host) The host app requires two entitlements: Entitlement Purpose com.apple.developer.web browser Enables default browser candidacy com.apple.developer.web browser engine.host Enables alternative engine extensions Both must be requested from Apple. The request process varies by region. Extension Entitlements Each extension target requires its type specific entitlement set to true : Extension Type Entitlement Web content com.apple.developer.web browser engine.webcontent Networking com.apple.developer.web browser engine.networking Rendering com.apple.developer.web browser engine.rendering Optional Entitlements Entitlement Extension Purpose com.apple.security.cs.allow jit Web content JIT compilation of scripts com.apple.developer.kernel.extended virtual addressing Web content Required alongside JIT com.apple.developer.memory.transfer send Rendering Send memory attribution; value is host app bundle ID com.apple.developer.memory.transfer accept Web content Accept memory attribution; value is host app bundle ID com.apple.developer.web browser engine.restrict.notifyd Web content Restrict notification daemon access Embedded Browser Engine (Non Browser Apps) Apps that are not browsers but embed an alternative engine for in app browsing use different entitlements: Entitlement Purpose com.apple.developer.embedded web browser engine Enable embedded engine com.apple.developer.embedded web browser engine.engine association Declare engine ownership engine association is available starting iOS/iPadOS/Mac Catalyst 26.2 and is set to first party when you own the engine or third party when another developer owns it. Embedded engines use arm64 only (not arm64e ), cannot include browser extensions, and cannot use JIT compilation. Japan Specific Requirements Browser apps distributed in Japan are supported on iOS 26.2+ and must adopt the current security mitigations Apple lists for Japan, including Pointer Authentication Codes and Memory Integrity Enforcement for relevant allocators and extension processes. Enable hardware memory tagging with com.apple.security.hardened process.checked allocations ; Apple strongly recommends enabling it in the EU as well. Architecture A browser built with BrowserEngineKit consists of four components running in separate processes: The host app launches and manages all extensions. Extensions cannot launch other extensions. Extensions communicate with each other through anonymous XPC endpoints brokered by the host app. Bootstrap Sequence 1. Host launches web content, networking, and rendering extensions 2. Host creates XPC connections to each extension 3. Host requests anonymous XPC endpoints from networking and rendering 4. Host sends both endpoints to the web content extension via a bootstrap message 5. Web content extension connects directly to networking and rendering This architecture follows the principle of least privilege: the web content extension works with untrusted data but has no direct OS resource access. Process Management Launching Extensions Each extension type has a corresponding process class in the host app: Pass nil for bundleIdentifier to use the default extension target. The interruption handler fires if the extension crashes or is terminated by the OS. Creating XPC Connections Each process type provides makeLibXPCConnection() to create an xpc connection t for communication. Stopping Extensions After calling invalidate() , no further method calls on the process object are valid. Extension Types Web Content Extension Hosts the browser engine's HTML parser, CSS engine, JavaScript interpreter, and DOM. Conform to WebContentExtension to handle incoming XPC connections: Configure via WebContentExtensionConfiguration in the extension's EXAppExtensionAttributes . Networking Extension Handles all network requests using URLSession or socket APIs. One instance serves all tabs: Configure via NetworkingExtensionConfiguration . Rendering Extension Accesses the GPU via Metal for video decoding, compositing, and complex rendering. One instance typically serves the entire browser: Configure via RenderingExtensionConfiguration . Capabilities Grant capabilities to extensions so the OS schedules them appropriately: Available Capabilities Capability Use Case .foreground Active tab rendering, visible content .background Background tasks, prefetching .suspended Minimal activity, pending cleanup .mediaPlaybackAndCapture(environment:) Audio/video playback, camera/mic capture Media Environment For media capabilities, create a MediaEnvironment tied to a page URL. The environment supports AVCaptureSession for camera/mic access and is XPC serializable for cross process transport: Visibility Propagation Attach a visibility propagation interaction to browser views so extensions know when content is on screen. Both WebContentProcess and RenderingProcess provide createVisibilityPropagationInteraction() . Layer Hosting and View Coordination The rendering extension draws into a LayerHierarchy , whose content the host app displays via LayerHierarchyHostingView . Handles are passed over XPC. Use LayerHierarchyHostingTransactionCoordinator to synchronize layer updates atomically across processes. See [references/browserenginekit patterns.md](references/browserenginekit patterns.md) for detailed layer hosting examples and transaction coordination. Text Interaction Adopt BETextInput on custom text views to integrate with UIKit's text system. This enables standard text selection, autocorrect, dictation, and keyboard interactions. Key integration points: asyncInputDelegate for communicating text changes to the system handleKeyEntry( :completionHandler:) for keyboard events BETextInteraction for selection gestures, edit menus, and context menus BEScrollView and BEScrollViewDelegate for custom scroll handling See [references/browserenginekit patterns.md](references/browserenginekit patterns.md) for detailed text interaction implementation. Sandbox and Security Restricted Sandbox After initialization, lock down content extensions using the restricted sandbox: This removes access to resources the extension used during startup but no longer needs. Use the latest available revision for the strongest restrictions. JIT Compilation Web content extensions that JIT compile JavaScript must transition pages with BrowserEngineKit's witnessed APIs: Requires the com.apple.security.cs.allow jit and com.apple.developer.kernel.extended virtual addressing entitlements on the web content extension only. If an implementation instead uses pthread jit write with callback np , it also needs the JIT write allowlist entitlement; do not present BE JIT WRITE PROTECT TAG alone as a complete protection strategy. arm64e Requirement Distribution builds must satisfy the current alternative browser entitlement profile's device architecture, PAC, and MIE requirements. Keep the host and extension configuration consistent, include the required device slices, and test the signed archive on eligible devices. Embedded engines differ: they are arm64 only and cannot use JIT. Do not force arm64e onto Simulator builds or copy a one line ARCHS override that drops required slices. Downloads Report download progress to the system using BEDownloadMonitor . Create an access token, initialize the monitor with source/destination URLs and a Progress object, then call beginMonitoring() to show the system download UI. Use resumeMonitoring(placeholderURL:) to resume interrupted downloads. BEDownloadMonitor is available on iOS 18.2+. See [references/browserenginekit patterns.md](references/browserenginekit patterns.md) for full download management examples. Common Mistakes DON'T: Skip the bootstrap sequence DON'T: Launch extensions from other extensions DON'T: Use extension process objects after invalidation DON'T: Apply JIT entitlements to non content extensions JIT compilation entitlements ( com.apple.security.cs.allow jit ) are valid only on web content extensions. Adding them to the host app, rendering extension, or networking extension causes App Store rejection. DON'T: Hard code region eligibility DON'T: Forget to set UIRequiredDeviceCapabilities Without web browser engine in UIRequiredDeviceCapabilities , users on unsupported devices can download the app and hit runtime failures. Review Checklist [ ] com.apple.developer.web browser engine.host entitlement on host app [ ] Each extension has its type specific entitlement [ ] UIRequiredDeviceCapabilities includes web browser engine [ ] arm64e instruction set configured for all iOS device targets [ ] arm64e is not set for Simulator targets [ ] Swift packages built with iOSPackagesShouldBuildARM64e workspace setting [ ] Extension point identifiers set correctly in each extension's Info.plist [ ] Interruption handlers implemented for all process types [ ] Bootstrap sequence connects content extension to networking and rendering [ ] Capabilities granted before work begins and invalidated when done [ ] Visibility propagation interaction added to browser content views [ ] Restricted sandbox applied to content extensions after initialization [ ] BEAvailability used for eligibility checks instead of manual region logic [ ] Memory attribution entitlements use the host app bundle ID as their value [ ] Download progress reported via BEDownloadMonitor for active downloads on iOS 18.2+ [ ] Memory tagging enabled for Japan distribution on iOS 26.2+ (recommended for EU) References Extended patterns (text interaction, layer hosting, scroll views, file bo