Safari sidebar silently loads all your bookmarks

Safari sidebar silently loads loads all your bookmarks

July 6 2026

Safari was inactive, in the background, with no windows open, when out of the blue I got a Little Snitch alert:

Safari wanted to connect to the URL http://192.168.0.1/favicon.ico for some reason. The IP address 192.168.0.1 is private.

I quickly realized that http://192.168.0.1/ was one of my bookmarks, for the web interface of my router. I had recently been looking at my bookmarks in order to answer someone’s question on Reddit about Safari bookmarks, though I hadn’t looked specifically at that particular bookmark or its containing folder.

My rules in Little Snitch mostly allow Safari to connect to the web, because of course Safari is a web browser. However, I do have a rule to ask about outgoing connections to the local network, triggering the alert above. Sometimes malicious websites attempt to probe your local network, so I want to be alerted if that happens. When I checked Little Snitch Network Monitor, I discovered that Safari apparently connected to all of my bookmarks within the past hour. I have a lot of bookmarks, and some of them are very old, because I’ve been using Safari for more than 20 years. The connection to my router bookmark was the only one I noticed, due to the Little Snitch alert, whereas all of the other connections, bookmarks to the public internet, occurred silently in the background, allowed by Little Snitch.

I used the FileMerge app, bundled inside the Xcode app, to diff my current ~/Library folder with a recent backup. What I found was not what I expected. My ~/Library/Safari/Favicon Cache folder was mostly unchanged, but hundreds of new files were added to my ~/Library/Safari/Metadata Cache folder. The latter contains LPLinkMetadata.db, which is an SQLite database, along with an LPLinkMetadata folder full of property list (plist) files. These files are of various sizes, the largest 5.6 MB, that specify metadata for my bookmarks: URLs, page titles, image data. Clearly, the Metadata Cache is generated by Apple’s Link Presentation:

The Link Presentation framework enables you to present content-rich URLs in a consistent way. Retrieve metadata from a URL, present the rich link content inside your app, and provide link metadata to the share sheet experience in iOS.

I performed some additional testing in Safari, disabling the Little Snitch rules that allow connections by default. As far as I can tell, the Edit Bookmarks main menu item, which I usually use and which displays your bookmarks in the current Safari tab, does not trigger any connections to your bookmarks. On the other hand, the Show Bookmarks main menu item, which opens the Safari sidebar, does trigger connections! I almost never use the sidebar for anything, but I happened to open the sidebar to bookmarks while I was helping the aforementioned Redditor. You can even see little website previews if you browse your bookmarks in the sidebar.

Needless to say, I’m not fond of this behavior. My fundamental principle is that my web browser should not load any website without my explicit consent, e.g., clicking a link, clicking a bookmark, or entering a URL in the address bar. Opening the sidebar does not constitute consent to load hundreds of websites. Perhaps regular Safari sidebar users are already aware of this and find it acceptable? I don’t know, but I don’t find it acceptable, and hopefully I can remember in the future to avoid opening the sidebar, because I’m not aware of any other workaround for the automatic URL loading.

This issue reminds me of something I wrote about a few years ago: Safari share menu now violates privacy. Indeed, it might have the exact same cause: Link Presentation. According to my quote from the Apple developer documentation, the Link Presentation framework enables the developer to “provide link metadata to the share sheet experience in iOS.” That seems true in macOS too. I assume, without the benefit of a utility like Little Snitch on iOS, forbidden by Apple, that what I’m seeing in macOS Safari also happens in iOS Safari. If I were sufficiently motivated, I suppose that I could test indirectly on macOS with Little Snitch and the Xcode iOS simulator, always an interesting counter to Apple’s marketing that “what happens on iPhone stays on iPhone.”

By the way, a little over a week ago Safari inexplicably lost all of my bookmark favicons, the site icons that display next to your bookmarks. These are stored in the ~/Library/Safari/Favicon Cache folder—separately from the Link Presentation previews in the ~/Library/Safari/Metadata Cache folder—and generated only when you visit the website manually (thereby respecting user consent). Fortunately, I was able to restore my favicon cache from backup. I don’t think this is related to the link preview loading, which is demonstrably triggered by opening the sidebar, but I thought I’d mention it anyway, if only because it’s another...