webloc files trigger a Gatekeeper alert in the latest macOS security updates

A webloc file is essentially a website bookmark. You can create a webloc file by dragging a URL from the Safari address bar and dropping into Finder. The file format is very simple, a URL wrapped in a binary property list. % plutil -p Example\ Domain.webloc { "URL" => "https://example.org/" } Opening a webloc file, for example by double-clicking in Finder, now triggers a Gatekeeper alert in the latest versions of macOS Golden Gate and Tahoe, 27.2 and 26.7.2 respectively, though oddly not in macOS Sequoia 15.8.2. This alert appears regardless of your default web browser. If you allow the webloc to open, then subsequent attempts to open that file will no longer trigger the alert, which is the same way that Gatekeeper alerts work for downloaded apps. I could not find anything relevant in the macOS 27.2 security release notes, but the document is extremely long and each entry terse, in typical Apple fashion. (Indeed I suspect that Apple neglected to credit me for the Hide My Email…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town