[macOS Sequoia] Emoji do not render when in lockdown mode

[joshqou]

OS/Platform

macOS

Installed

Other (please use 'Additional context' field below to mention how exactly)

Version

136.0.7103.92

Have you tested that this is not an upstream issue or an issue with your configuration?

• I have tried reproducing this issue in Chrome and it could not be reproduced there
• I have tried reproducing this issue in vanilla Chromium and it could not be reproduced there
• I have tried reproducing this issue in ungoogled-chromium with a new and empty profile using --user-data-dir command line argument and it could not be reproduced there

Description

When lockdown mode is enabled, Emoji do not render.

How to Reproduce?

1. Install ungoogled-chromium from brew
2. Enable Lockdown Mode in macOS preferences
3. Emoji should no longer render in Ungoogled Chromium

Actual behaviour

Expected behaviour

Google Chrome:

Firefox:

Relevant log output

Additional context

Ungoogled Chromium Version: 136.0.7103.92 (Official Build, ungoogled-chromium) (arm64)
Google Chrome Version: 136.0.7103.114 (Official Build) (arm64)
Firefox Version: 138.0.4 (aarch64)
macOS Version: 15.5

Example website used is https://emojipedia.org/

[joshqou]

This seems to be specific to the viewport as emoji render just fine in the omnibar and in JavaScript prompts. Emoji do not render in devtools

Enabled Flags:

disable-qr-generator
disable-search-engine-collection
disable-sharing-hub
disable-top-sites
enable-compute-pressure-rate-obfuscation-mitigation
enable-fingerprinting-protection-blocklist
enable-fingerprinting-protection-blocklist-incognito
enable-isolated-sandboxed-iframes
enable-webrtc-hide-local-ips-with-mdns
extension-mime-request-handling
fingerprinting-canvas-image-data-noise
fingerprinting-canvas-measuretext-noise
fingerprinting-client-rects-noise
force-punycode-hostnames
no-default-browser-check
no-pings
popups-to-tabs
remove-cross-origin-referrers
remove-grab-handle
remove-tabsearch-button
scroll-tabs
scrollable-tabstrip
show-avatar-button
spoof-webgl-info

[PF4Public]

I assume it is a mac-specific issue then?

[joshqou]

@PF4Public Yes. Lockdown mode is a macOS feature.

[joshqou]

Noticed that I checked "I have tried reproducing this issue in ungoogled-chromium with a new and empty profile using --user-data-dir command line argument and it could not be reproduced there" by accident. The issue is reproducible in fresh profiles

[PF4Public]

I'll move your issue into the corresponding repository

[Qubik65536]

Can you check if the Vanilla Chromium (downloadable here) has the same behavior?

[joshqou]

@Cubik65536 Same behaviour in 138.0.7198.0 (Developer Build) (arm64)

[Qubik65536]

@Cubik65536 Same behaviour in 138.0.7198.0 (Developer Build) (arm64)

Then, even though I hate saying this, this is an issue to be reported to Chromium dev team, and it is very unlikely to be fixed in UGC unless Chromium fixes this issue...

[joshqou]

@Cubik65536 Seems this issue has already been reported upstream. I'll forward the info here

[joshqou]

ma…@chromium.org: I suspect this is due to ImageIO's support for lockdown mode. When ImageIO detects lockdown mode is enabled it shifts much of its processing to an XPC service (com.apple.ImageIOXPCService). The function that decides whether to use the XPC service (___IIOIsOOPEnabled_block_invoke) has an exclusion list for bundle IDs that are exempt from using the XPC service, even in lockdown mode:

com.apple.IDSBlastDoorService
com.apple.MediaAnalysisBlastDoorService
com.apple.MessagesAirlockService
com.apple.MessagesBlastDoorService
com.apple.QuickLookThumbnailing.extension-secure
com.apple.WebKit.WebContent
com.apple.WebKit.WebContent.CaptivePortal
com.apple.WebKit.WebContent.Crashy
com.apple.WebKit.WebContent.Development
com.apple.WebKit.WebContentCaptivePortalExtension
com.apple.WebKit.WebContentExtension
com.apple.quicklook.thumbnail.AudiovisualExtension
com.apple.quicklook.thumbnail.ImageExtension
com.apple.quicklook.thumbnail.OfficeExtension
com.apple.quicklook.thumbnail.TextExtension
com.brave.Browser.helper.renderer
com.google.Chrome.helper.renderer
com.microsoft.edgemac.helper.renderer
com.operasoftware.Opera.helper
company.thebrowser.browser.helper.renderer
org.qt-project.Qt.QtWebEngineProcess

I'd guess if you run Chromium in lockdown mode with --enable-logging --enable-sandbox-logging you'll find sandbox violations reported in Console.app that mention com.apple.ImageIOXPCService.

Mystery solved as to why Chrome is unaffected. Chrome is exempt from this protection. Also tested with Brave and it works in Brave too.