Here’s a PNG that will show a different image in Apple Software

This is wild: while writing his own parallel-decodable PNG implementation, David Buchanan discovered he had a bug in his code. Soon after, he found out Apple has the same bug in their implementation which ships with macOS and iOS.

As a result, it’s possible to craft a PNG in such a way that Apple’s decoder will show a different image. Because Safari delegates the task of decoding images to the OS, all Apple browsers — including MobileSafari — also show the “wrong” image.

If you’re using Apple-flavoured software, you should see “HELLO APPLE”, and on all other software, you should see “HELLO WORLD”.

Here’s a side-by-side comparison:

Chrome (left) vs. Safari (right) showing the Ambiguous PNG

Because other desktop browsers on macOS — such as Google Chrome and Mozilla Firefox — use their own built-in PNG decoder, they are not affected by this. On iOS however, all browsers are affected because all browsers on iOS are essentially nothing more than a differently skinned MobileSafari.

David also created a tool to craft your own PNG.

PNG Parser Differential →
Ambiguous PNG Packer →

Published by Bramus!

Bramus is a frontend web developer from Belgium, working as a Chrome Developer Relations Engineer at Google. From the moment he discovered view-source at the age of 14 (way back in 1997), he fell in love with the web and has been tinkering with it ever since (more …)

Join the Conversation

2 Comments

  1. >Chrome uses its built-in PNG decoder
    Chrome on iOS too?
    The iOS web rendering restriction is a really under-complained-about issue. It’s one of the reasons FireFox got destroyed in “market share” and it’s hurt the web and the Internet.

    1. Chrome on iOS is forced to use the built-in WebKit Engine; the same one that powers Safari. Therefore it is also affected by it.

      Good call. Will update the post to clarify this.

Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.