How to Fix dom-to-image Security Errors on iOS Browsers

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

There is no single client-side switch that fixes every dom-to-image security error on iOS. First determine whether a cross-origin image or canvas has tainted the export, or whether Safari is failing to render the SVG <foreignObject> technique used by dom-to-image libraries. Fix CORS when the resource server is under your control. If Safari still returns a blank or inconsistent image, generate SVG and rasterize it on a server.

What the error actually means

dom-to-image-style libraries clone a DOM node, copy its styles and resources, serialize the result into XML, wrap that XML in an SVG <foreignObject>, and draw the SVG through an off-screen canvas. The final export normally calls canvas.toDataURL(), canvas.toBlob(), or an equivalent readback method.

#	Preview	Product	Price
1		Apple iPhone 14, 128GB, Midnight - Unlocked (Renewed)	$300.00	Buy on Amazon
2		Apple iPhone 16, 128GB, Pink - Unlocked (Renewed)	$599.99	Buy on Amazon
3		Apple iPhone 15, 128GB, Black - Unlocked (Renewed)	$414.99	Buy on Amazon
4		Apple iPhone 13, 128GB, Midnight - Unlocked (Renewed)	$262.00	Buy on Amazon
5		Apple iPhone 16e, 128GB, Black - Unlocked (Renewed)	$389.00	Buy on Amazon

Two security-related failures can occur in that pipeline:

• Canvas tainting: an image or other resource from another origin was drawn without CORS permission. Browser readback then throws a SecurityError.
• Safari foreignObject rendering: iOS Safari can produce blank or varying output even when the resources have correct CORS headers, because its SVG and <foreignObject> implementation is stricter and image decoding can be timing-sensitive.

These causes need different remedies. Correct CORS does not guarantee reliable Safari rasterization.

#1 Best Overall

Apple iPhone 14, 128GB, Midnight - Unlocked (Renewed)

• This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
• Please check with your carrier to verify compatibility.
• The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charging cable.
• Tested for battery health and guaranteed to have a minimum battery capacity of 80%.

$300.00

Buy on Amazon

Start with a reproducible diagnosis

1. Record the complete failure. Save the exact exception text, the method that failed (toDataURL, toBlob, or a library promise), the iOS version, Safari or in-app webview, and your dom-to-image package and version.
2. Reduce the target. Capture a plain element containing only local text and CSS. If that works, add images, fonts, SVGs and canvases one at a time. This identifies the resource that changes the result.
3. Inventory every drawable resource. Check each <img>, CSS background, web font, embedded SVG, video frame and child canvas. A child canvas that was tainted earlier remains unreadable; cloning its parent cannot repair it.
4. Inspect the console and network panel. Look for blocked image requests, failed font loads, cross-origin stylesheet access errors and messages saying that a canvas is tainted.

Distinguish the two paths

A clear SecurityError during canvas readback, especially after adding a remote image, points to CORS or an already-tainted child canvas. A successful promise that produces a transparent, blank or intermittently incomplete image after all resources load is more consistent with Safari’s <foreignObject> path or canvas limits.

Fix cross-origin images with CORS

Canvas security is controlled by both sides of the request. The browser must request the image in CORS mode, and the image server must explicitly permit the page’s origin in its response. Setting an attribute in your HTML alone cannot grant access to a server that omits the header.

Set crossOrigin before src

const image = new Image();
image.crossOrigin = "anonymous"; // set before src
image.onload = () => {
  // Add the image to the DOM or draw it only after it has loaded.
};
image.onerror = (event) => console.error("Image failed", event);
image.src = "https://cdn.example.com/hero.jpg";

Use use-credentials only when the server is configured for credentialed CORS. For anonymous requests, the response generally needs an Access-Control-Allow-Origin value matching your page (or a wildcard where credentials are not involved). Configure this on the image host, CDN or object-storage bucket, and make sure caches vary correctly by Origin when multiple origins are allowed.

Verify the response, not just the markup

In browser developer tools, inspect the image response headers. Confirm that the request was made in CORS mode and that the response contains a compatible Access-Control-Allow-Origin. A 200 status without that permission header still taints the canvas. Redirects also matter: every redirecting resource must remain CORS-readable.

Rank #2

Apple iPhone 16, 128GB, Pink - Unlocked (Renewed)

• 6.1" Super Retina XDR OLED, HDR10, Dolby Vision, 1000nits (typ), 2000nits (HBM), 2556x1179px at 460ppi, 3561mAh Battery
• 128GB 8GB RAM, Apple A18 (3nm), Hexa-core (2x4.04 GHz + 4x2.20 GHz), Apple GPU 5-core, 16‑core Neural Engine
• Rear camera: 48MP, f/1.6, wide + 12MP, f/2.2, ultrawide, Front Camera: 12MP, f/1.9, wide, iOS 18, upgradable to iOS 18.5
• 4G LTE: 1/2/3/4/5/7/8/12/13/14/17/18/19/20/25/26/28/29/30/32/34/38/39/40/41/42/48/53/66/71, 5G: n1/2/3/5/7/8/12/14/20/25/26/28/29/30/38/40/41/48/53/66/70/71/75/76/77/78/79 - Dual eSIM
• Unlocked for freedom to choose your carrier. Compatible with both GSM & CDMA networks. The phone is unlocked to work with all GSM Carriers & CDMA Carriers Including AT&T, T-Mobile, Verizon, Sprint., Etc.

$599.99

Buy on Amazon

When you cannot change the image server

Use an authorized server-side proxy that fetches the asset and serves it from your own origin with appropriate CORS headers. Dom-to-image-more documents proxy and resource-interception options, along with an image-error callback and placeholders. Proxy only assets you are permitted to retrieve; never forward cookies, authorization headers or private URLs to an untrusted host.

Handle stylesheets, fonts and embedded SVG separately

Cross-origin stylesheets can prevent JavaScript from reading cssRules. A library may skip those rules or fall back, producing an incomplete capture rather than a direct security exception. Host critical styles on the same origin, configure stylesheet CORS where supported, or inline the styles needed for the capture.

Fonts need to finish loading before cloning. Await document.fonts.ready, and wait for image decode() promises where available. If a font cannot be fetched with permission, expect a fallback font and different line wrapping.

SVG files can contain external images, styles or nested <foreignObject> elements. Treat them as independent cross-origin resources. An SVG that looks harmless in an <img> can still make the eventual canvas unreadable.

Rank #3

Apple iPhone 15, 128GB, Black - Unlocked (Renewed)

• 6.1inch Super Retina XDR display. Aluminum with color-infused glass back. Ring/Silent switch
• Dynamic Island. A magical way to interact with iPhone. A16 Bionic chip with 5-core GPU
• Advanced dual-camera system. 48MP Main | Ultra Wide. Super-high-resolution photos (24MP and 48MP). Next-generation portraits with Focus and Depth Control. 4X optical zoom range
• Emergency SOS via satellite. Crash Detection. Roadside Assistance via satellite
• Up to 26 hours video playback. USB C, Supports USB 2. Face ID

$414.99

Buy on Amazon

Wait for real content before exporting

Lazy images, animations and asynchronous data frequently look like security failures. Before calling dom-to-image, scroll or otherwise trigger lazy loading, wait for the target images, and disable transitions for the capture.

await document.fonts.ready;

const images = [...document.querySelectorAll("#capture img")];
await Promise.all(images.map(async (img) => {
  if (!img.complete) {
    await new Promise((resolve) => {
      img.addEventListener("load", resolve, { once: true });
      img.addEventListener("error", resolve, { once: true });
    });
  }
  if (img.decode) {
    try { await img.decode(); } catch (_) {}
  }
}));

const node = document.querySelector("#capture");
const blob = await domtoimage.toBlob(node);

Use the package’s documented image-error callback or placeholder behavior so one failed decorative asset does not silently invalidate the entire export.

Safari’s foreignObject fallback: export SVG, rasterize elsewhere

If CORS is correct and a small, fully loaded test still renders blank or inconsistently on iOS, stop trying to force client-side rasterization. The dom-to-image-more documentation identifies Safari as an unreliable target for this technique and recommends producing SVG with toSvg, then rasterizing that SVG in a controlled server environment.

const svgDataUrl = await domtoimage.toSvg(document.querySelector("#capture"));
// Send the SVG data to your server for controlled PNG/JPEG rasterization.
await fetch("/api/rasterize", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ svg: svgDataUrl })
});

Server-side rendering still needs resource handling. Embed permitted assets as data URLs, make the rasterizer able to fetch only approved hosts, set a deterministic viewport and wait for fonts before rendering. Do not assume that every SVG is safe or self-contained merely because it was generated by your page.

Rank #4

Apple iPhone 13, 128GB, Midnight - Unlocked (Renewed)

• This pre-owned product is not Apple certified, but has been professionally inspected, tested and cleaned by Amazon-qualified suppliers.
• There will be no visible cosmetic imperfections when held at an arm’s length.
• This product is eligible for a replacement or refund within 90 days of receipt if you are not satisfied.
• Product may come in generic Box.

$262.00

Buy on Amazon

Check limits and adjacent failure modes

Canvas dimensions

Very large full-page captures can exceed an iOS canvas limit and become partially drawn or blank. Lower the scale, capture sections, reduce the viewport or export SVG for server rasterization. There is no single canvas-size limit that applies to every iOS release and device, so treat the limit as device-dependent.

WebGL content

If the target includes a canvas created by your code with WebGL, request the context with preserveDrawingBuffer: true when you need to snapshot it. Otherwise its drawing buffer may be cleared before dom-to-image reads it.

const gl = canvas.getContext("webgl", { preserveDrawingBuffer: true });

In-app browsers

Browsers embedded inside apps can differ from Safari while sharing iOS WebKit constraints. Record the host app and webview version separately; do not infer a version-wide compatibility guarantee from one device.

Or skip the browser setup

For production captures, ScreenshotNeo performs the browser work on its screenshot API. It removes cookie and consent banners, newsletter popups and chat widgets before capture; bot checks, blank pages and failed loads are not billed; and its response reports the page verdict and billing status in headers. An MCP server provides take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients.

Every plan includes the same feature set: full-page and selector captures, device and viewport controls, dark mode, retina scale, custom CSS and JavaScript, waits, request blocking, cookies and headers, geolocation, PDF output, caching, signed links, asynchronous webhooks and bulk capture.

Best Value

Apple iPhone 16e, 128GB, Black - Unlocked (Renewed)

• 6.1" Super Retina XDR OLED, HDR10, 800 nits (HBM), 1200 nits (peak), 2532x1170px at 460ppi, 4005mAh Battery
• 8GB RAM, Apple A18 6-core CPU (2 performance + 4 efficiency cores), Apple GPU 4-core, 16‑core Neural Engine
• Rear camera: 48MP, f/1.6, wide, Front Camera: 12MP, f/1.9, wide, iOS 18.3.1, upgradable to iOS 18.5
• Connectivity: Global 4G LTE, Sub-6 GHz 5G, LTE, Wi-Fi 6, Bluetooth 5.3, NFC, USB-C, Wireless Charging (7.5W). (does not have mmWave 5G or MagSafe or physical SIM card) - Dual eSIM Only
• Unlocked for freedom to choose your carrier. Compatible with both GSM & CDMA networks. The phone is unlocked to work with all GSM Carriers & CDMA Carriers Including AT&T, T-Mobile, Verizon, Straight Talk., Etc.

$389.00

Buy on Amazon

Use the API documentation at https://screenshotneo.com/docs/ for parameter details. A minimal request is:

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

Python

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
r.raise_for_status()
open("shot.webp", "wb").write(r.content)

Node.js

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
const data = Buffer.from(await res.arrayBuffer());
await import('node:fs/promises').then(fs => fs.writeFile('shot.webp', data));

The Free plan includes 1,000 shots per month with no card. Paid plans start at $5 for 3,000 shots; yearly billing provides two months free. Create a free ScreenshotNeo account to start.

Troubleshooting checklist

• “The operation is insecure” or “tainted canvas”: find the first remote image, SVG or child canvas; enable CORS on the request and response, or remove/proxy the asset legally.
• CORS appears correct but output is blank on iOS: test a local-only node, then switch to toSvg and server rasterization.
• Text differs from desktop: wait for document.fonts.ready, verify font responses and disable animations.
• Images are missing: wait for lazy loading and decoding; use the library’s error callback to identify failed URLs.
• Only very large captures fail: reduce scale or split the page; suspect canvas dimensions rather than CORS.
• A WebGL chart is empty: recreate its context with preserveDrawingBuffer: true before drawing.
• Styles disappear: move critical CSS same-origin or provide stylesheet CORS; inaccessible cssRules cannot be fixed in JavaScript.

Choosing the remedy

Frequently Asked Questions

Does adding crossOrigin="anonymous" always solve the error?

No. The remote server must also return a compatible Access-Control-Allow-Origin header, and an already-tainted child canvas cannot be repaired by cloning.

Is every iOS browser affected in exactly the same way?

No. iOS browsers and embedded webviews share WebKit constraints but can differ by release and host. Test the versions and webviews you support.

Can I keep the entire process client-only?

Only when resources are CORS-readable and Safari successfully rasterizes the generated SVG. Otherwise the documented fallback is SVG output followed by server-side rasterization.

The Bottom Line

Fix the specific failure, not the error label: grant CORS permission for every drawable resource when the canvas is tainted; otherwise bypass Safari’s unreliable <foreignObject> rasterization by sending generated SVG to a controlled server.

Quick Recap

Bestseller No. 1

Apple iPhone 14, 128GB, Midnight - Unlocked (Renewed)

Please check with your carrier to verify compatibility.; Tested for battery health and guaranteed to have a minimum battery capacity of 80%.

$300.00

Bestseller No. 2

Apple iPhone 16, 128GB, Pink - Unlocked (Renewed)

$599.99

Bestseller No. 3

Apple iPhone 15, 128GB, Black - Unlocked (Renewed)

Dynamic Island. A magical way to interact with iPhone. A16 Bionic chip with 5-core GPU; Emergency SOS via satellite. Crash Detection. Roadside Assistance via satellite

$414.99

Bestseller No. 4

Apple iPhone 13, 128GB, Midnight - Unlocked (Renewed)

There will be no visible cosmetic imperfections when held at an arm’s length.; Product may come in generic Box.

$262.00

Bestseller No. 5

Apple iPhone 16e, 128GB, Black - Unlocked (Renewed)

$389.00

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.