What is "com.apple.WebKit.Networking.xpc" doing in my Firewall options - allow incoming connections?

I periodically check things around my system. Today I discovered an entry in my Firewall Options that I don't recognize and do not remember ever seeing before -


com.apple.WebKit.Networking.xpc Allow incoming connections


I have found some discussions (here in Apple Communities) that say it's part of Safari ...


But when I google "com.apple.WebKit.Networking.xpc" I see posts that say it's a serious bit of malware that hijacks browsers.


Can anyone shed any light on what this really is?

MacBook Pro

Posted on Mar 20, 2019 3:17 PM

Reply
11 replies

Mar 20, 2019 6:54 PM in response to MartinR

Hello...


https://discussions.apple.com/thread/8130078


https://hotvirusmalwareremoval.com/steps-remove-com-apple-webkit-networking-xpc-mac/#parttwo


Post a report from this please...


EtreCheck is a simple little app to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to help people help you with your Mac.


https://www.malwarebytes.com/mac/


There is also Malwarebytes…


https://www.malwarebytes.com/mac/


That being said I have it on every OS version since at least 10.8...


/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc

Mar 21, 2019 6:33 PM in response to BDAqua

Regarding the site hotvirusmalwareremoval.com - the name itself made me suspicious, so I googled it and NEARLY ALL the hits were pages on the site itself. I could not find ANY third-party reviews of the site, its products or services; and there is nothing in any Wiki about it. This makes me very suspicious of the site.


In addition, if com.apple.WebKit.Networking.xpc is in fact an Apple/macOS component why is this site making extraordinary claims that it's "a dangerous computer infection which hijacks your internet browsers" and then offers steps to remove it?


I understand you probably can't answer that question, but the entire situation surrounding that site makes me very suspicious that it could be a scam and source of malware. There have been plenty of other rogue sites that claim to clean up your Mac, remove viruses, etc. that leave you off much worse than when you started ... Mac Cleaner/macPaw, anyone, for example?



Mar 21, 2019 7:53 PM in response to MartinR

Regarding the site hotvirusmalwareremoval.com - the name itself made me suspicious, so I googled it and NEARLY ALL the hits were pages on the site itself. I could not find ANY third-party reviews of the site, its products or services; and there is nothing in any Wiki about it. This makes me very suspicious of the site.


I'm sorry I listed that site... so much for my thinking processes some times.

Mar 21, 2019 6:33 PM in response to BDAqua

The file is located in /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices


Here is what GetInfo reported:


The permissions are:

system - Read & Write

wheel - Read Only

everyone - Read Only


ps. It appears to be an Apple product (unless it's possible to spoof information that GetInfo would report on a file).


This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

What is "com.apple.WebKit.Networking.xpc" doing in my Firewall options - allow incoming connections?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.