Apple's WebKit team on October 26, 2026 published "WebKit Features for Safari 27.2," a post by Jen Simmons that adds one styling hook for HTML select menus, renames a property in the CSS Grid Lanes layout system and lists 20 bug fixes. One of those fixes, filed under Networking, ends a seven-day cap Safari had been placing on cookies set by a website's own page response whenever the site's hostname was an alias for a different domain.

The post opens with a summary of its own scope: "Safari 27.2 is here, refining Customizable Select, renaming a Grid Lanes property, and delivering 20 bug fixes across accessibility, media, CSS, and more." It says nothing about tracking prevention or the advertising domains Safari 27 blocks. That gap matters, because 27.2 is the version number on the beta build Apple asked The Trade Desk to test on October 5.

In Short

Apple updated Safari to version 27.2, and one of its 20 repairs stops the browser from wrongly cutting some websites' own cookies down to one week. It matters for sites whose web address is routed through another company's servers, such as a content delivery network, because logins, saved preferences and visitor counts tied to those cookies could reset for Safari users after seven days. The fix covers only cookies a site sets when a page loads, and the update says nothing about Safari's other one-week limits or about the advertising domains the browser blocks.

One line under Networking

The cookie fix takes up a single bullet in the post. "Fixed cookies set by a top-level navigation's own response being capped to a seven-day lifetime when the site's hostname is CNAMEd to a different registrable domain," according to WebKit. The entry carries the internal tracking number 183787115.

Each part of that sentence narrows the case. A top-level navigation is the request a browser makes for the page itself, when someone types an address, follows a link or arrives from an ad. Its "own response" is the document the server sends back, and cookies set in it arrive in the headers of that page rather than from a script or a separate request. A CNAME is a DNS record that makes one hostname an alias for another. When www.example.com is a CNAME for a host on a provider's domain, the two names belong to different registrable domains, the unit browsers call eTLD+1.

That arrangement is routine. Sites delivered through a CDN, and many hosted website and e-commerce platforms, have customers point a www hostname at a name on the provider's own domain. Under the bug, Safari limited cookies set in those sites' page responses to seven days, the lifetime its tracking defences reserve for disguised trackers.

What sits in those cookies depends on the site. Page responses commonly set login sessions, shopping baskets and consent records, and some server-side measurement setups write visitor identifiers there as well. For a Safari visitor who returned after more than a week, any of them could have disappeared. PPC Land described the measurement version of that problem in October, when an analysis of Safari's seven-day cap on cloaked tracking subdomains opened with a shopper who buys eight days after an ad click and is recorded as a new user.

The post leaves several questions open. It does not say when the behaviour began, which Safari versions were affected, how many sites were hit, or what happens to cookies already stored with the shortened expiry. Nor does it describe the change as anything more than a bug fix.

Why Safari caps cookies at seven days at all

Seven days is a familiar number in Safari. Under Intelligent Tracking Prevention, cookies created by JavaScript have long been capped at seven days of browser use. Cookies set by a server in an HTTP response used to escape that limit, which is why server-set cookies became the standard recommendation among measurement vendors.

WebKit closed part of that route in 2020. In a November 12, 2020 post by John Wilander, WebKit defined third-party CNAME cloaking as a first-party subresource that resolves through a CNAME differing both from the first-party domain and from the top frame host's own CNAME, if there is one. Cookies set in the HTTP responses of such requests were capped at seven days, starting with Safari 14. Safari 16.4, released on March 27, 2023, extended the same cap to IP address cloaking, comparing the network address of a tracking response with that of the main site, as the October analysis set out in detail.

Read against that definition, the bug fixed in 27.2 sat outside the rule WebKit itself had published. The 2020 defence was written for subresources, the extra requests a page makes, and it explicitly allowed for the top frame host having a CNAME of its own. Capping cookies on the top-level page response, simply because the site's hostname was an alias, went further than the published definition. That reading is PPC Land's, but it fits WebKit's decision to list the change under bug fixes rather than describe it as a policy shift.

What the fix leaves alone

The fix is limited to the top-level navigation's own response. The post does not mention cloaked tracking subdomains, such as an sst.example.com endpoint that resolves to a tagging provider's network. It does not mention the IP address comparison added in Safari 16.4, the seven-day cap on cookies written by JavaScript, or same-origin paths such as example.com/metrics. Server-side tagging setups that triggered the cloaking cap before 27.2 are, on the evidence of the post, in the same position after it.

So does the fix reach server-side tracking subdomains? Nothing in the post says it does. The entry describes the page response alone.

Silence on the blocked ad domains

The post's silence on tracking prevention is notable because of what has happened to Safari 27 since it began rolling out with iOS 27 on September 14. The release shipped with a private, unconditional block on a list of domains that included adsrvr.org, The Trade Desk's ad request and delivery domain, enforced through an 11-line WebKit change merged in February. Ian Meyers of The Trade Desk filed WebKit bug 324771 on September 21.

On October 5, Wilander, the author of the 2020 cloaking post, told Meyers that a new iOS 27.2 beta had gone out and asked him to test it. Meyers replied that he could see the changes in build 24B5099f, and PPC Land reported at the time that the ticket stayed open with no public account of what had changed. A later report covered Apple's request for The Trade Desk to test an iOS 27.2 build that may unblock ads, noting that it was unclear whether the change would reach the production release. On October 8, ADOTAT's Pesach Lattin wrote that The Trade Desk's domain had been unblocked in the test build while ID5 would stay on the list, a claim Apple had not confirmed when PPC Land covered the column.

Safari 27.2 is now the shipping version on iOS 27.2, according to WebKit. Yet the post does not mention tracking prevention, Link Tracking Protection, blocked domains, adsrvr.org or identity resolution. It does not refer back to WebKit's October 19 post explaining why Safari 27 blocks identity firms that turn email addresses into tracking IDs. The Safari 27.1 post three days earlier, written around iPhone Duo, was equally silent.

That does not settle anything either way. The domain list lives in a file that exists only in Apple's internal builds, so a change to it would not necessarily appear in WebKit's public release notes. Whether production iOS 27.2 carries the change seen in build 24B5099f cannot be established from the post, which offers nothing on it.

A styling hook for select menus

The largest section of the post covers Customizable Select, which first landed in Safari 27.0, the version that shipped with iOS 27. "Since then, the web standards process continues to polish details. And implementations across all browsers are being updated to match," according to WebKit.

The background is a problem web designers have lived with for decades. When someone picks an option from a <select> element, the chosen text appears in the control's button, and browsers have offered little control over how it looks. Customizable Select added a <selectedcontent> element that lets a page decide what appears in that button and how. WebKit's example is an order status menu with four options: Processing, Shipped, Delivered and Canceled.

Using <selectedcontent> is optional, and Safari 27.2 adds a way to style the displayed value without it. "Now in Safari 27.2, the new ::field-content pseudo-element gives you the ability to style the text of the selected option that's displayed on the page, without needing the

Four default browser styles for appearance: base-select also change in 27.2, according to WebKit:

  • the button's contents centre vertically more reliably
  • the selected option text now inherits text-overflow from the <select>
  • the ::picker-icon is drawn differently, so its layout is more straightforward
  • the button uses flex: 1 to manage spacing, instead of margin-inline-start: auto on ::picker-icon, so the picker icon stays visible even without <selectedcontent>

A separate fix addresses large menus. Previously, a long select picker could render partly outside the viewport. Safari 27.2 keeps it in view by applying safe alignment, which comes from a broader change to CSS alignment: for absolutely and fixed positioned boxes, the safe keyword now keeps the box within its original containing block. The safe and unsafe keywords can now also be combined with normal alignment.

Select menus are everywhere in commerce: country and size pickers at checkout, quantity selectors, industry and company-size fields on lead forms. Many sites have replaced the native control with JavaScript widgets to match their brand. The post makes no claim about how many will switch back, and it does not say which other browsers support ::field-content.

Grid Lanes: flow-tolerance becomes fit-tolerance

The CSS section concerns Grid Lanes, which shipped in Safari 26.4 in March 2026. Grid Lanes arranges items of uneven height into columns, the staggered layout used for image galleries and card-based feeds. Since its release, the CSS Working Group has decided to rename the flow-tolerance property to fit-tolerance "to better describe its purpose," and Safari 27.2 adopts the new name.

The old name has not disappeared. "Meanwhile, the older name will keep working for now as a deprecated alias," according to WebKit, which asks developers to update their code soon and says Safari Web Inspector marks what needs to change. The post gives no date for removing the alias.

WebKit's explanation of the property is plain. "It controls how picky the browser is when it chooses where to put the next item," the post states. Without tolerance, the browser places each new item in the column whose content ends highest on the page. With fit-tolerance, columns within the defined distance of each other count as tied, and the browser picks the first. The default is fit-tolerance: 1em.

The reason to raise it, in WebKit's account, is accessibility. A higher tolerance keeps consecutive items in neighbouring columns rather than jumping back and forth across the page to chase small differences in height. That helps people moving through content with the keyboard, especially sighted keyboard users who watch focus move from item to item. "So most of the time, you should increase this number significantly," the post states, adding that the right value depends on content sizes and how much they vary. It points readers to the Field Guide to Grid Lanes at gridlanes.webkit.org and to its earlier article, "Introducing CSS Grid Lanes."

Twenty fixes across 14 categories

The rest of the post is a list. "In addition to these updates, in our continuing commitment to quality, WebKit for Safari 27.2 includes 20 bug fixes," according to WebKit. By PPC Land's count, they fall into 14 categories. Media accounts for five, accessibility for three, and the remaining twelve categories carry one fix each. For scale, the Safari 27.1 post listed none, while Safari 18.4, announced in March 2025, brought 84 new features and 184 fixes.

Media

Video and audio playback received the most attention. The five media fixes cover:

  • AudioContext.decodeAudioData() failing with an EncodingError on valid AAC and M4A audio files
  • video showing a black screen while audio kept playing after the video decoder was invalidated
  • ManagedMediaSource not firing the startstreaming event when a viewer seeks to a point that is not buffered, which could stall playback
  • a media element's play() promise not being resolved when a SourceBuffer contained clear, unencrypted content
  • the WebCodecs VideoEncoder stalling and producing no output for H.264 Main and High profiles

ManagedMediaSource is WebKit's power-managed version of the interface web players use to feed adaptive streams to the browser segment by segment, so a stall on seek could affect any player built on it. The clear-content fix concerns streams that mix unencrypted segments with protected ones. That happens in several common setups, including unencrypted lead-in segments used to speed up start times and ad breaks stitched into protected programmes through server-side ad insertion. The post does not say which scenario surfaced the bug. The VideoEncoder fix matters to browser-based tools that create or compress video, since H.264 Main and High are widely used profiles.

Page events, clipboard and screen readers

Several fixes touch behaviour that scripts on a page depend on. One addresses the window load event never being dispatched when a readystatechange handler starts a new load. Any script waiting for that event, including tag manager triggers set to fire on window load, would have waited indefinitely on an affected page.

Another concerns transient activation, the short window after a click or tap during which a browser lets a page use sensitive features. According to WebKit, Safari could discard it incorrectly, "causing APIs gated on user activation (such as the Clipboard API) to fail on the first attempt." Copy buttons for promo codes, referral links and share URLs are typical users of that API.

The accessibility fixes are specific. VoiceOver had been repeating text it had already announced when a page streamed content by re-rendering an aria-live region instead of appending to it. That is a pattern common in chat interfaces that display AI responses as they are generated, though the post does not use that example. List, table, tree and canvas content had been left out of an element's accessible name or description when the containing element was referenced by aria-labelledby or aria-describedby. On iOS, VoiceOver did not identify date, time and colour inputs as pop-up buttons.

The remaining fixes are narrower:

  • Animations: animation-range-start and animation-range-end resolved incorrectly when zoom was applied, including when the value was inherited from an element with a different zoom factor.
  • CSS: an anchor-positioned element inside a modal <dialog> could be laid out offscreen and become invisible when the page was scrolled.
  • Forms: the default content for the ::picker-icon in Customizable Select now renders with a glyph that no longer needs negative margins to align.
  • JavaScript: for await...of over an async generator skipped the Promise.prototype.constructor lookup that PromiseResolve requires when that property is replaced.
  • SVG: dynamic changes to a <foreignObject> element's x and y values had no effect.
  • WebGPU: a severe frame rate drop occurred when calling executeBundles() with render bundles containing drawIndirect() or drawIndexedIndirect().
  • WebRTC: getUserMedia() requests for audio permanently failed with NotAllowedError after the system audio service was reset.

Safari MCP and extensions

One fix concerns Safari MCP, the server that lets AI agents drive Safari through the Model Context Protocol. According to WebKit, the fix stops "Safari taking keyboard focus from other apps when creating tabs or capturing screenshots under Safari MCP control." Those are two of the core operations: when WebKit shipped the Safari MCP server with 17 tools for AI debugging agents in Safari Technology Preview 247 on July 1, the tools included one to create a new tab and one to capture a PNG screenshot of the current page. Before the fix, an agent working in the background could pull focus away from whatever the person at the keyboard was doing.

The Web Extensions fix addresses "a significant delay before web extension content is injected when Safari is cold launched." Extensions that inject scripts or styles into pages, a group that can include ad blockers and shopping tools, depend on that step. The post does not quantify the delay or name affected extensions.

Where Safari 27.2 runs

Safari 27.2 is available on iOS 27.2, iPadOS 27.2, visionOS 27.2, macOS 27.2 Golden Gate, macOS Tahoe and macOS Sequoia, according to WebKit. On iOS, iPadOS, visionOS and macOS Golden Gate it arrives as part of the operating system update, through Settings > General > Software Update. On the two older macOS versions, Safari can be updated on its own from Software Update by clicking "more."

The post closes with a request for feedback, naming Simmons, Saron Yitbarek and Jon Davis as WebKit's evangelists and pointing to Apple's Feedback Assistant, the WebKit bug tracker and webcompat.com for sites that do not work as expected. "Filing issues really does make a difference," it states.

What it means for measurement

For the advertising and analytics trade, Safari 27.2 is a small release with one directly relevant line. The cookie fix runs in the direction of longer persistence, for a defined set of sites: those whose own hostname is an alias for another domain, and only for cookies set in the page response. It does not reopen any of the routes WebKit has closed on purpose. It also stands apart from the broader direction of Safari 27, which in its beta blocked LinkedIn and Bing ad trackers by IP address and shipped with domain-level blocks on identity resolution services. Those changes followed Safari 26 making Advanced Fingerprinting Protection the default for all browsing in September 2025.

The fix also shows how much of Safari's privacy behaviour reaches the industry through bug lists rather than announcements. A seven-day cap on first-party page cookies could have distorted returning-visitor counts, frequency measurement and attribution windows longer than a week on affected sites, wherever those relied on cookies set in the page response. It was disclosed, once fixed, in one line between an SVG entry and a Safari MCP entry. Any effect would show up as a shift in Safari return rates on those sites after the update, and the post offers no figures to check it against.

And for The Trade Desk, ID5 and the publishers that depend on them, the most important question about iOS 27.2 is one the release notes do not address.

Timeline

Summary

Who: Apple's WebKit team, in a post by Jen Simmons, addressing web developers. The cookie fix affects sites whose hostname is a CNAME alias for another domain, and the people who measure traffic on them.

What: Safari 27.2 adds the ::field-content pseudo-element and refines default styles for Customizable Select, renames the Grid Lanes property flow-tolerance to fit-tolerance with the old name kept as a deprecated alias, and lists 20 bug fixes across 14 categories. One fix ends a seven-day cap on cookies set by a top-level page response when the site's hostname is CNAMEd to a different registrable domain. The post says nothing about tracking prevention or Safari's blocked advertising domains.

When: October 26, 2026, three days after the Safari 27.1 post and three weeks after Apple asked The Trade Desk to test an iOS 27.2 beta.

Where: Safari on iOS 27.2, iPadOS 27.2, visionOS 27.2, macOS 27.2 Golden Gate, macOS Tahoe and macOS Sequoia.

Why: The standards process has continued to adjust Customizable Select and Grid Lanes since they shipped, and WebKit is bringing Safari in line. The cookie entry corrects behaviour that went beyond WebKit's own 2020 definition of CNAME cloaking, which was written for subresources and allowed for a site's own CNAME. Whether iOS 27.2 also changes the domain block that hit The Trade Desk is a question the post leaves unanswered.