WebKit Leaks Expose Real IPs in Proxy Browsers and Apple's iCloud Private Relay

Three features in Apple's WebKit browser engine can bypass proxy configurations on iOS and macOS, exposing users' real network information even when they believe their traffic is routed through a privacy service, security researchers reported on August 4.

The Three Leaks

The team at Mysk, which makes the Psylo proxy browser, identified three WebKit features that send traffic outside the configured proxy:

• DNS prefetching: Resolves hostnames through the device's normal DNS path, revealing the user's real DNS servers. Available since iOS 26.0.
• WebAuthn Related Origin Requests: The operating system's credential service fetches a validation file directly from the device, exposing the real IP address. Available since iOS 18.0.
• WebTransport: Opens a direct HTTP/3 connection that bypasses the proxy. Available since iOS 26.4.

Who Is Affected

The leaks affect any iOS browser that relies on WebKit's proxy configuration API, including all iOS Tor browsers and Psylo. They also affect Apple's own iCloud Private Relay. VPNs are not affected because they tunnel traffic at the system level. Mysk has reached out to the Tor Project and the developers of Onion Browser.

The Proof of Concept

Mysk set up a demonstration site at leaks.psylo.app that can detect the leaks. The investigation began when a Psylo user noticed DNS leaks on certain websites. As Mysk dug deeper, it found the two additional leaks that expose the device's real IP address.

Mitigations

Psylo 1.3.1 blocks all three leaks by default: it blocks dns-prefetch hints, disables WebTransport, and disables WebAuthn. Users can re-enable WebAuthn or WebTransport per site through explicit toggles, keeping the trade-off visible. Mysk says the fixes prove the leaks are addressable, but they should not be necessary in the first place.

Why It Matters

Because Apple requires every iOS browser to use WebKit, the engine's behavior defines the privacy ceiling for all browsing on the platform. Users who rely on proxy browsers or iCloud Private Relay to hide their identity now have evidence that those protections can fail silently.