iOS 10.3 fixed a mobile Safari pop-up issue that plagued users who were unfortunate enough to visit a site that served an ad containing malicious JavaScript. The folks at security firm Lookout wrote up the scope of the problem and confirmed Apple repaired it in 10.3.
However, Lookout told me that the problem Jason Snell wrote about at Macworld in November 2016 wasn’t part of the macOS update. Older versions of macOS remain more susceptible than El Capitan and Sierra, but I’ve still had sketchy sites I visit in researching security stories try a variety of techniques to fill windows with ads or scams and prevent them from closing. (Apple confirmed that a pop-up technique was fixed between Yosemite and El Capitan.)
If you’re still using an older version of iOS, which might be because you have a device too old to update to iOS 10, here’s how you break out of the Safari-scam capture loop:
- Open Settings > Safari.
- Tap Clear History and Website Data.
- Confirm.
IDG Deleting the mobile Safari cache regains access to the browser with pre-iOS 10.3 systems hijacked by malicious Web sites.
This will lose the list of URLs you’ve visited recently, cookies, and data cached locally by Web sites on your browser.
A warning, however: If you’re signed into the same iCloud account in multiple places and have Safari set to sync to any of those other devices, this clear operation also deletes browser history (but not cookies and other data) from all those linked Macs, iPhones, and iPads.
The way around that? Disable sync on the other devices in iOS via Settings > Your Account Name > iCloud in iOS and flipping the Safari switch to off, and on macOS via the iCloud system preference pane by unchecking the Safari box. Then re-enable after performing step 2 above.
With macOS, Jason details a few options in his column linked above, but the simplest method (and the one that ultimately worked for him) was as follows:
- Force Quit Safari: hold down the Option key and select Safari from the Dock and then choose Force Quit, or press Command-Option-Escape, select Safari from the applications list, and click Force Quit.
- Disconnect the Mac from the Internet by either turning the Wi-Fi adapter off from the Wi-Fi menu (Turn Wi-Fi Off) or disconnecting the ethernet connection if it’s hard wired. (You could also disconnect your Internet broadband connection temporarily if that’s easier.)
- Launch Safari. The remote page cannot load and Safari will display an error.
- Open Safari > Preferences and delete whatever scammy URL is the Homepage field. Close Preferences.
- Reconnect the Internet to the computer or your network.
Ask Mac 911
We’ve compiled a list of the questions we get asked most frequently along with answers and links to columns: read our super FAQ to see if your question is covered. If not, we’re always looking for new problems to solve! Email yours to mac911@macworld.com including screen captures as appropriate. Mac 911 can’t reply to—nor publish an answer to—every question, and we don’t provide direct troubleshooting advice.
Author: Glenn Fleishman, Senior Contributor
Glenn Fleishman’s most recent books include Take Control of iOS and iPadOS Privacy and Security, Take Control of Calendar and Reminders, and Take Control of Securing Your Mac. In his spare time, he writes about printing and type history. He’s a senior contributor to Macworld, where he writes Mac 911.