Safari

Is Safari safe?

Yes. For most iPhone, iPad and Mac owners, Safari is one of the safest and most private browsers available, and it needs no setup. It blocks cross-site cookies and known trackers by default, Apple turned on fingerprinting protection for all browsing with iOS 26 in 2025, and your synced history is encrypted so that Apple cannot read it. The weak spots are a handful of WebKit bugs used in targeted spyware attacks and the fact that Safari is fixed only when you install a system update. We score it 81/100, one point above Brave (80) and far ahead of Google Chrome (59).

How does Safari block tracking?

Safari's Intelligent Tracking Prevention uses on-device machine learning to spot trackers and stops third-party cookies from following you between sites. Apple's own comparison page says Safari blocks third-party cookies by default and hides your IP address from known trackers, while Chrome does neither by default. Safari 26 went further: Advanced Fingerprinting Protection, which makes devices look alike to tracking scripts, is now on in all browsing rather than only in Private Browsing.

A few things still leave your device. Apple's Safari privacy page, last updated in December 2025, says that Fraudulent Website Warning sends a code worked out from each address to Google Safe Browsing and Apple (Tencent in mainland China and Hong Kong), and that Google may log your IP address. Privacy Preserving Ad Measurement, which reports ad clicks to advertisers without cookies and with a random delay of 24 to 48 hours, is on by default. Page translation sends the full page text to Apple. Apple's App Store label lists browsing and search history as collected but not linked to you, and only user content and a device ID as linked.

Is Safari secure against hackers?

Mostly yes. Apple marked three WebKit flaws as possibly exploited in 2024: CVE-2024-23222, fixed in January, and CVE-2024-44308 and CVE-2024-44309, fixed in Safari 18.1.1 in November after attacks on Intel-based Macs. It marked three more in 2025. CVE-2025-24201, fixed in March, was a sandbox escape used in what Apple called "an extremely sophisticated attack". In December 2025, Safari 26.2 fixed CVE-2025-43529 and CVE-2025-14174, both used against specific people on iOS versions before iOS 26. The second was a graphics bug shared with Chrome. Apple's advisories for 2026 up to October list no exploited WebKit flaw.

Two things set Safari apart. First, iCloud encrypts Safari history, Tab Groups and iCloud Tabs end to end by default, which Chrome and Edge do not. Second, Safari's fixes ship with the operating system, so an iPhone too old for the current iOS gets fewer of them. On iPhone that matters for every browser, because outside the EU Chrome, Firefox and Edge must all use WebKit too.

Hide IP Address and Private Relay

Every Safari user can send connections to known trackers through two relays, so no single company sees both who you are and which tracker you reached. iCloud+ subscribers can also send all Safari traffic through Private Relay, which hides their IP address from websites. Apple's privacy page lists the setting as Settings, Apps, Safari, Hide IP Address, with the choices Trackers and Websites, Trackers Only, or Off. Private Relay is not a full VPN: it does not cover every app.

Safari for children

Safari benefits from the iPhone's system-wide parental controls. Apple says Limit Adult Websites is on by default for children under 18 in a family group, and Ask to Browse, which needs a parent's approval for new sites, is on by default for children under 13. Apple says these controls cover Safari and other supported browser apps, because the filter works at the system level.

How to make Safari safer

1. Install iOS, iPadOS and macOS updates promptly. Safari's security fixes ship with them.
2. Check that Advanced Tracking and Fingerprinting Protection is set to all browsing in Safari's advanced settings, not only Private Browsing.
3. Pick a different search engine in Safari's settings if you would rather your searches did not go to Google.
4. Turn off Privacy Preserving Ad Measurement in Safari's advanced settings if you want no ad reports at all.
5. Give extensions access only to the sites they need. Apple's privacy page says each extension must be granted permission to read pages.
6. If you might be targeted by spyware, turn on Lockdown Mode, which limits some web features.

How we scored it

Privacy (82), security (80) and transparency (80) are all strong, helped by tracking protection on by default and end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary history. Security loses points for the six WebKit flaws exploited in 2024 and 2025 and fixes tied to system updates. The regulatory record (88) reflects an EU browser choice case that closed without a fine. For a browser that works outside Apple devices, see Firefox.