These are not delivered along with the notification-- they're provided (client-side) by the application that the notification was sent for. So, while a notification could display dynamic content here depending on the content of the notification (for example, this is the same mechanism as used by Mail on iOS for mail previews) and the preview code should take the untrusted nature of the content into account if it does, it doesn't have to and it's not any different than running the application itself in terms of security issues.

A web browser displayed dynamic content all the time and is considered safe.

No. Nowadays you should still disable JavaScript as well as video playback in your browser if you want to be safe.

There was a brief period some years ago where browsers looked "pretty safe", but we have quickly backtracked by stuffing JS and browsers full of new APIs that are creating new vulnerabilities.

Edit: Yes. Downvoting will surely reduce the amount of CVEs.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sand...

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox

There were also Chrome RCEs & sandbox escapes discovered in the wild as recently as November:

https://twitter.com/benhawkes/status/1323374326150701057

https://googleprojectzero.github.io/0days-in-the-wild/0day-R...

And for Firefox:

https://googleprojectzero.github.io/0days-in-the-wild//0day-...

I mean you might as well just disable all connectivity on your computer if you only feel safe by not having CVEs show up in a search. Generally people want to still receive content though and are looking for the safest ways to do that, not ways to re-enact Bubble Boy, and for that browsers actually rank pretty good against most any other ways to get dynamic content.

The question wasn't "what is the safest way to display dynamic content", the question was "is displaying dynamic content (this way) safe".

And the answer is no. Web browsers are the safest way to run arbitrary code in a sandbox on your computer - which is what dynamic content in this context really means - the same way that aiming at your feet is the safest way to shoot yourself.

I’ve run NoScript for years. I selectively enable JS. It’s fine.

You'll be safe because you can't effectively use the modern internet :)

Dissenters and dissidents stick together; you have my vote.

Not sure how macOS does it but iOS has notification service and content extensions. The original notification in itself is pretty lightweight. However, the service extension allows an app to perform additional downloading and data retrieval from which it can augment the notification data. From there, the notification content extension can take this enlarged notification and present a custom, interactive view controller. So yeah, almost none of the data is from the notification itself. I haven’t explored the limits of what APIs are available to a notification content extension but it wouldn’t surprise me if what’s seen here is possible on iOS, too.