Safari extension makes Strava website unusable - [Warning] [blocked]...requested insecure content from webkit-masked-url://hidden/. This content was blocked... (uc.js, line 2:111478)

[Prochy]

Steps To Reproduce

1. Go to a detail another person in Strava.com
2. Check Side by Side Comparison or Photos part in UI
   Note: The issue doesn't occur all the time (in my case 90%).

Expected Result

Both controls load well without issue.

Actual Result

Currently it stuck at loading point.

Screenshots or Videos

No response

Additional Context

It works fine when the extension is uninstalled.

There are those warnings in the console log not sure if they're relevant:

[Warning] [blocked] The page at https://www.strava.com/athletes/xy requested insecure content from webkit-masked-url://hidden/. This content was blocked and must be served over HTTPS. (uc.js, line 2)

[Warning] The resource https://web-assets.strava.com/assets/federated/reporting/remoteEntry.js?t=2025-12-28T09:35:01+00:00 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it wasn't preloaded for nothing.
[Warning] The resource https://web-assets.strava.com/assets/federated/feed/remoteEntry.js?t=2025-12-28T09:35:02+00:00 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it wasn't preloaded for nothing.
[Warning] The resource https://web-assets.strava.com/assets/federated/notifications/remoteEntry.js?t=2025-12-28T09:35:02+00:00 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it wasn't preloaded for nothing.
[Warning] The resource https://web-assets.strava.com/assets/federated/cpra-compliance-cta-wrapper/remoteEntry.js?t=2025-12-28T09:35:02+00:00 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it wasn't preloaded for nothing.

Operating System

macOS

Operating System Version

15.7.3

Web Browser

Safari

Browser Version

Version 26.2 (20623.1.14.18.4)

Environment Versions

Version: 2025.12.0

SDK: 'main (0107af7)'

Server version: 2025.12.1

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-30263
Link (for internal use): https://bitwarden.atlassian.net/browse/PM-30263

[bwbug]

I would try to add web-assets.strava.com to the block list (Settings > Autofill > Blocked Domains) and to the exclusion list (Settings > Notifications > Excluded domains). If that doesn't work, also add www.strava.com first to the exclusion list, and then also to the block list (if the exclusion list alone does not solve the problem).

[bwbug]

Also, it seems that the issue may in part be caused by your user script uc.js, which is not part of Bitwarden. Do you have customizations like Tampermonkey? What happens if you disable all customizations and add-ons in your browser except for the Bitwarden extension?

[Prochy]

Unfortunately none of the advices helped (Blocked Domains/Excluded Domains: web-assets.strava.com, www.strava.com, strava.com). What helped is turning off the Bitwarden extension in Safari for strava.com, didn't know it's possible (Safari -> Settings -> WebSites -> Bitwarden -> strava.com Deny) which is currently enough for me as workaround since I'm using Login with Google button.

There is only Bitwarden extension, the uc.js comes from cookiebot.com. To be honest no idea how it can interfere with BW extension.

[rmcdowell-bitwarden]

Hi there,

I am unable to reproduce this issue, it has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

[Prochy]

Understand, that it's probably some strange random issue, unfortunately not sure what else could help to reproduce the issue.

What I have tried to solve the issue (without success):

1. Clear the whole history (Allowing all cookies in strava.com - by default I always clicked allow essentials only)
2. Disable "Prevent cross-site tracking"/"Hide IP address" features

[bwbug]

@Prochy Could you try with Cookiebot disabled or uninstalled?

[Prochy]

The cookiebot is third-party solution for managing cookies on the website that is used by strava.com itself, it's not an extension.