While looking at Activity Monitor processes, I noticed a process whose name started with "http://".

Shortly after observing and screenshoting the process disappeared. This morning, it briefly re-appeared and then died.

lsof and dtracte indicate the process is looking at standard system libraries, one of which is /private/var/db/mds/messages/se_SecurityMessages.

Any ideas on:

  1. Whether this is a normal process?
  2. How to find where and how it's launched? (Mac doesnt have /proc...?)
  3. How to investigate what its doing?
  • dtruss shows extremely minimal activity, lots of workq_kernreturn , kevent64, etc Commented Jan 14, 2015 at 16:14
  • Alright, I never use Safari. But I fired it up to go the mac developer forums. When I visit idmsa.apple.com, I see a named process for that popup in Activity Monitor. Say what? Commented Jan 14, 2015 at 16:47
  • If I open tabs for other webpages, they also spin up processes with names corresponding to the webpage. But since I've never visited mall... , and I wasn't running safari at the time, why this process? Commented Jan 14, 2015 at 16:52
  • I noticed the same when i've visited asw.apple.com yesterday. Perhaps it is a process the browsers start to display the markup language?
    – Jules
    Commented Jan 14, 2015 at 17:08
  • I think Safari is spinning off a separate process for each webpage. Activity Monitor is helpfully digging down into it to pull out the name of the webpage. Commented Jan 14, 2015 at 17:21

1 Answer 1


This is Normal in the way Safari now operates.

Each process is part of Safari sandboxing.

If you go to the View menu in Activity Monitor and down to the 'All Processes Hierarchically'

enter image description here

You will see that they all gathered and are owned by Safari.

enter image description here

Also this is a known feature: apple.com/safari

Sandboxing for websites.

Sandboxing provides built-in protection against malicious code and malware by restricting what websites can do. And because Safari runs web pages in separate processes, any harmful code you come across in one page is confined to a single browser tab, so it can’t crash the whole browser or access your data.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .