Safari 27.2 fixes a cookie bug that quietly capped CNAMEd domains

Apple shipped Safari 27.2 on 26 October. Buried among its 20 bug fixes is one that matters more than the headline features: cookies set during a top-level navigation to a domain CNAMEd to a different registrable domain were being silently capped to a seven-day lifetime, no matter what Max-Age or Expires the response actually set.

That pattern shows up anywhere a vendor’s infrastructure is reverse-proxied onto a first-party subdomain, for analytics, email or support widgets. The release also finishes work on Customizable Select: a new ::field-content pseudo-element styles the selected option’s text without needing a <selectedcontent> element, and large pickers now use safe alignment to stay inside the viewport. Separately, the CSS Working Group renamed the Grid Lanes property flow-tolerance to fit-tolerance; the old name still works as a deprecated alias.

Why it matters: if you or a vendor you embed CNAMEs a domain onto your own and sets a cookie meant to outlive a week, Safari was silently cutting it short before 27.2. Worth retesting session and tracking cookie lifetimes on any CNAMEd domain now that the fix is out.

select::field-content {
  font-weight: bold;
}