WebKit leaks can expose users behind iCloud Private Relay

Three WebKit features can bypass configured proxy connections on iOS and macOS, exposing either a user’s DNS path or real IP address. The same flaws also affect Apple’s iCloud Private Relay, according to a security investigation from the developers of the Psylo proxy browser.

The issues affect WebKit-based proxy browsers because Apple’s App Store rules require iOS browsers to use WebKit. That includes iOS Tor browsers and Psylo, which rely on the WKWebsiteDataStore.proxyConfigurations API introduced in iOS 17 and macOS 14 to route web traffic through application-level proxies.

A proxy should ensure that websites see the proxy’s address rather than the device’s. These WebKit features operate outside that expected path.

The three WebKit leaks

The first issue involves DNS prefetching, which lets a webpage ask WebKit to resolve a hostname before the browser needs to connect to it. When a page includes a <link rel=“dns-prefetch”> tag, WebKit sends the lookup through the device’s normal DNS path, ignoring the browser’s configured proxy.

Recommended reading

UK weighs worker consultation rules for bossware

A malicious or investigative website could embed unique hostnames in those tags and monitor its authoritative DNS server. The incoming query would reveal the user’s real DNS servers and network, rather than the proxy’s. The issue is particularly selective: a site must include DNS prefetch tags to trigger it.

WebKit enabled this behavior on iOS in iOS 26.0, released in September 2025. Desktop Safari has supported DNS prefetching since Safari 5.

The second issue concerns WebAuthn Related Origin Requests, a feature used by passkeys. It allows an organization to use one passkey across several domains by having the operating system fetch a /.well-known/webauthn file that lists permitted origins.

That validation request is issued by the operating system’s credential service rather than WebKit’s browser network stack. As a result, it ignores the host application’s proxy. A webpage can choose an rpId host, and the request can be triggered without user interaction when WebAuthn uses conditional mediation. The destination server can therefore see the device’s real IP address.

The feature became available with iOS 18.0 and Safari 18.0 in September 2024.

The third issue affects WebTransport, a low-latency web protocol that runs over HTTP/3 and QUIC. It supports multiple independent streams and unreliable datagrams, with HTTP/2 fallback when QUIC is unavailable.

When a page creates a WebTransport connection, WebKit establishes it using its own network parameters and does not pass along the session’s proxy. The resulting connection goes directly from the device, exposing its real IP address. WebTransport shipped publicly on iOS 26.4 in March 2026, after being enabled for supported platforms in December 2025.

The report identifies one exception: Onion Browser’s Silver security level enables Lockdown Mode, which disables WebTransport. Users running that configuration are not affected by the WebTransport leak, although the other issues are separate.

iCloud Private Relay is also exposed

iCloud Private Relay is intended to proxy Safari’s web traffic and DNS queries through a two-hop relay for iCloud+ subscribers. The design prevents any one party, including Apple, from seeing both a user’s identity and the sites they visit.

These WebKit features bypass that protection because they operate outside the normal page-loading path that Private Relay proxies. DNS prefetch requests use the device’s normal DNS route, while WebAuthn validation and WebTransport connections are issued directly by system components or WebKit’s separate networking path.

The result is that a website or DNS operator can identify the user’s real network even when Private Relay is enabled. VPNs are not affected, because they tunnel the device’s entire network connection at the system level rather than relying on WebKit’s application-level proxy configuration.

The investigation began with a Psylo user report about DNS leaks that appeared only on certain websites. The developers then found the WebAuthn and WebTransport issues, which expose the real IP address rather than only the DNS path.

Psylo’s developers say they have contacted the Tor Project and the developers of Onion Browser. They also provide a proof-of-concept testing site at leaks.psylo.app.

Psylo 1.3.1 blocks the features by default

Psylo 1.3.1 addresses all three issues by:

• Blocking dns-prefetch hints.
• Disabling WebTransport by default.
• Disabling WebAuthn by default.

WebAuthn and WebTransport can still be enabled through per-silo toggles for sites that require passkeys or WebTransport functionality. That makes the privacy trade-off explicit, but it also means users must choose between compatibility and protection on a site-by-site basis.

The practical impact is significant for iOS proxy browsers: a proxy configuration that appears to cover all browser traffic does not necessarily cover WebKit’s auxiliary networking features. Private Relay has the same architectural gap, while system-level VPNs do not.

The report does not identify an Apple response or a WebKit-wide fix. Until that changes, Psylo’s mitigation is to turn off the affected features rather than repair the underlying platform behavior.