Apple Begins Warning Users That 'Legacy System Extensions' Won't Work With a Future Version of macOS

Apple has shared a new support document that indicates kernel extensions — which it calls "legacy system extensions" — will not be compatible with a future version of macOS because they "aren't as secure or reliable as modern alternatives."

System extensions are a category of software that works in the background to extend the functionality of your Mac. Some apps install kernel extensions, which are a kind of system extension that works using older methods that aren't as secure or reliable as modern alternatives. Your Mac identifies these as legacy system extensions.

Starting in macOS 10.15.4, released this week, a warning will now appear when a kernel extension first loads, and again periodically while the extension remains in use. Users began noticing the warning during beta testing.

macos catalina legacy system extension alert
Apple says it began informing developers that macOS Catalina will be the last macOS to fully support kernel extensions in 2019, adding that it has been working with developers to transition their software. A final transition date has not yet been set, but some developers are assuming that kernel extensions will be deprecated in macOS 10.16.

Apps with kernel extensions will continue to work in macOS Catalina.

"By moving beyond these extensions, developers are helping to further modernize the Mac, improve its security and reliability, and enable more user-friendly software distribution methods," the support document reads.

One affected app is Malwarebytes, which said that "a significant percentage of our total support case volume" was related to the new kernel extension warning less than 24 hours after the public release of macOS 10.15.4.


Malwarebytes director Thomas Reed said Apple has a new EndpointSecurity framework as a replacement for kernel extensions:

We are aware of this, and have been working on replacing our kernel extension since late last year. We plan to replace it with Apple's new EndpointSecurity framework before the release of macOS 10.16, when it is assumed that kernel extensions will no longer work, in part or in full. (We only know that Apple has said they "will not work without compromise" in "a future version of macOS." But we'd rather not find out the hard way exactly what that means.)

The kernel extension will continue to be supported for macOS 10.14 (Mojave) and earlier, but macOS 10.15 (and later) will no longer need it, once we have an update available.

So, no need to panic. We've still got your back, and won't let your protection falter. All you've got to do is make sure you're keeping Malwarebytes for Mac up-to-date. If you have updated to at least version 4.2, and have not disabled the new auto-update feature, it'll update itself in the background without you needing to do anything. To ensure you're up-to-date, just open Malwarebytes and choose Check for Updates from the Malwarebytes menu.

Technical details for developers are available in an Apple document titled "Deprecated Kernel Extensions and System Extension Alternatives."

Top Rated Comments

JimmyBanks6 Avatar
24 months ago

It's nothing to do with security.
"Sandboxing software is nothing to do with security"

You heard it here first folks. ?
Score: 18 Votes (Like | Disagree)
chrfr Avatar
24 months ago

It's nothing to do with security.
It's specifically about stability and also security.
The new system extensions will not have sufficiently low level access to the system to cause kernel panics. That's a big improvement regardless of the motivation.
Score: 18 Votes (Like | Disagree)
HiVolt Avatar
24 months ago
It's nothing to do with security. It's about total control of the hardware & software experience, like on iOS.

They've been doing it slowly but surely over the last number of years.
Score: 14 Votes (Like | Disagree)
cmaier Avatar
24 months ago

It's nothing to do with security. It's about total control of the hardware & software experience, like on iOS.

They've been doing it slowly but surely over the last number of years.
making drivers run in user space is absolutely about security.
Score: 10 Votes (Like | Disagree)
venom600 Avatar
24 months ago

"Sandboxing software is nothing to do with security"

You heard it here first folks. ?
So it is just a coincidence that the method of improving security they chose and continue to implement just happens to also reduce user control and limit how the machine can be used, right? I bet you think they removed the headphone jack out of courage too.
Score: 7 Votes (Like | Disagree)
cmaier Avatar
24 months ago

So it is just a coincidence that the method of improving security they chose and continue to implement just happens to also reduce user control and limit how the machine can be used, right? I bet you think they removed the headphone jack out of courage too.
It's not a coincidence, it's computer science. The more control you let a third-party app have over things outside it's own user space, the more likely it is to cause system instability and to present a security risk.
Score: 7 Votes (Like | Disagree)

Popular Stories

airpodsinear 1

AirPods Save Woman's Life With Feature Everyone Should Know

Friday January 21, 2022 2:13 am PST by
Apple's AirPods have been credited with saving a woman's life after a potentially fatal fall, People reports. When a 60-year-old florist in New Jersey tripped and hit her head in her studio, she lost consciousness and awoke heavily bleeding. With nobody around to call for help, she realized she had her AirPods in, and used a "Hey Siri" command to call 911. An operator was able to stay on the ...
iphone 13 earpods

Apple to Stop Including EarPods With Every iPhone Sold in France From Next Week

Friday January 21, 2022 3:21 am PST by
Apple will no longer include EarPods with every iPhone sold in France, starting on January 24, according to a notice posted by a French carrier (via iGeneration). Apple was previously required to include EarPods in the box with the iPhone due to a French law that required every smartphone sold in the country to come with a "handsfree kit," but the law has now been changed in favor of reducing the ...
peloton tv workout cardio

Apple Floated as Potential Buyer of Peloton

Friday January 21, 2022 6:11 am PST by
Following months of bleak news about Peloton's "precarious state," including the revelation that it has halted production of its bikes and treadmills, Apple is being floated as a potential buyer of Peloton's troubled fitness business. Yesterday, CNBC reported that Peloton will temporarily stop production of its connected fitness products due to a "significant reduction" in consumer demand, a ...
Questionable Design Decisions

Apple's Most Questionable Design Decisions in Recent Memory

Sunday January 23, 2022 2:59 am PST by
Apple has always emphasized the depth of thought that goes into the design of its products. In the foreword to Designed by Apple in California, a photo book released by the company in 2016, Jony Ive explains how Apple strives "to define objects that appear effortless" and "so simple, coherent and inevitable that there could be no rational alternative." But every once in a while even Apple...
Spring 2022 Apple Products Feature

New iPad Air, Macs, and iPhone SE With 5G Likely to Be Announced at Apple Event This Spring

Thursday January 20, 2022 8:32 am PST by
Earlier this week, Bloomberg's Mark Gurman tweeted that Apple "will be holding a spring event" to announce a new iPhone SE and other hardware. In a recent edition of his newsletter, Gurman said the event is likely to occur in March or April. Gurman did not elaborate on what "other hardware" will be announced at Apple's purported spring event, but rumors suggest at least four products are...
Upcoming Products 2022 Feature

Gurman: Apple Preparing 'Widest Array of New Hardware Products in Its History' for Fall

Sunday January 23, 2022 10:32 am PST by
Apple is working on a number of new products that are set to launch this fall, and Bloomberg's Mark Gurman says that it will be "the widest array" of new devices that Apple has introduced in its history. In his latest "Power On" newsletter, Gurman explains that Apple is working on four new iPhones (5G iPhone SE, iPhone 14, iPhone 14 Pro, and iPhone 14 Pro Max), an updated low-end MacBook Pro,...
apple watch series 7 aluminum colors yellowbg

Apple Watch Charging Bug Fixed in watchOS 8.4 Release Candidate

Thursday January 20, 2022 4:01 pm PST by
The watchOS 8.4 release candidate that was seeded to developers and beta testers this morning addresses an ongoing bug that could cause some Apple Watch chargers not to work properly with the Apple Watch. Back in December, we reported on a growing number of charging issues that Apple Watch Series 7 owners were facing. Since watchOS 8.3, there have been a number of complaints about...
safari icon blue banner

macOS Monterey 12.2 and iOS 15.3 Release Candidates Fix Safari Bug That Leaks Browsing Activity

Thursday January 20, 2022 1:30 pm PST by
The macOS Monterey 12.2 and iOS 15.3 release candidates that came out today appear to address a Safari bug that could cause your recent browsing history and details about your identity to be leaked to malicious entities. As shared last week by browser fingerprinting service FingerprintJS, there is an issue with the WebKit implementation of the IndexedDB JavaScript API. Any website that uses...
apple college discounts

Apple Walks Back UNiDAYS Verification Requirement for U.S. Education Store

Friday January 21, 2022 12:43 pm PST by
Earlier this week, Apple began requiring that customers taking advantage of educational discounts in the United States verify their status as a teacher, student, or school staff member through UNiDAYS. The requirement was a major change as Apple had never asked customers to go through a verification process in the United States before, and now, just three days after verification was added,...