Boynton also calls out the sheer number of fixes in WebKit, which he calls “one of the largest attack surfaces on the platform.”

It wouldn’t be, if Apple would allow other browsers to use their own rendering engines.

It’s true… it’d be replaced by a much LARGER attack surface.

With everybody on Webkit, a vulnerability in it applies to every browser and nearly all apps on iOS. If other engines were allowed, a threat would only apply to apps using that engine.

On the flip side, keeping the engine centralized means that a single fix will close a hole in every app, keeping unmaintained apps safer.

I wonder if it would be possible to implement Firefox or Chromium in webassembly and run it on top of WebKit — it wouldn’t be as performant, but would be an extra layer of sandbox. You could theoretically do this in any app that uses WebKit too.

You can sideload this gecko browser called reynard browser, it’s not that hard to sideload if you have a laptop or pc you can connect your phone to.

It worked fine in my ios 18.5, sometimes even better than webkit browsers lol, I used it alongside orion. If I remember correctly it did glitch when I activated JIT but I am not sure if it even supported 18.5 idk.

I used lara to sideload more than 3 apps with free dev license but that doesn’t extend to all versions ofc there is sidestore + livecontainer for best sideloading but it still is not the best. And stickdebug for JIT and also GPS spoofing apparently and idk what else.