-
Researchers found three flaws in Apple’s WebKit engine that can expose a user’s true IP address or DNS server.
-
The leaks affect privacy-focused browsers like Tor and Psylo, plus Apple’s own iCloud Private Relay.
-
Psylo’s newest update blocks the problem, but full protection still depends on Apple and other developers.
A privacy tool is supposed to hide your identity online. But new research shows Apple’s WebKit browser engine can still expose users, even when they use trusted privacy apps.
Developers Bakry and Mysk discovered three separate bugs in WebKit. These bugs allow websites to see a user’s real IP address or DNS server. This happens even when someone uses a proxy-based browser built to hide that information.
Three Ways WebKit Leaks Your Real Location
The investigation started after a Psylo user noticed DNS leaks on some websites. Bakry and Mysk traced this to a feature called DNS prefetching. Their research also uncovered two more issues, one tied to WebAuthn Related Origin Requests, and one tied to WebTransport.
All three problems bypass a system called WKWebsiteDataStore.proxyConfigurations. Apple introduced this API in iOS 17 and macOS 14. Privacy browsers use it to send traffic through remote servers. That way, websites see the proxy’s IP address instead of the real one.
DNS prefetching lets a website look up a domain name before a user needs it. WebKit sends this early request through the device’s normal DNS connection. It skips the proxy completely.
A website could give each visitor a unique web address and then track its DNS server. That lets the site figure out a visitor’s actual network. This bug appeared on iPhones running iOS 26.0, released in September 2025.
The second leak involves WebAuthn Related Origin Requests, a passkey feature added in iOS 18.0. When a website checks a passkey linked to another approved site, Apple’s system fetches a file from a special web address.
Apple’s credential service handles this request directly. It does not go through the browser’s proxy setup. A website can trigger this fetch quietly, without asking the user to click anything.
The third leak comes from WebTransport, a fast data protocol built on HTTP/3 and QUIC. When a website calls this feature directly, WebKit opens a new connection. That connection skips the proxy settings entirely. Apple added WebTransport support in iOS 26.4, released in March 2026.
How the Leaks Slip Past Privacy Tools
Apple requires every browser on the iOS App Store to run on WebKit. That means any app using WebKit’s proxy system could be affected, no matter what the app promises. iCloud Private Relay faces the same risk. The affected requests skip Safari’s usual protected path entirely.
System-wide VPNs stay safe from this issue. A VPN tunnels the entire device’s traffic, not just the browser’s traffic.
Not every privacy tool suffers equally. Onion Browser users on its strongest safety setting are protected from the WebTransport leak. That setting turns on WebKit Lockdown Mode, which shuts off WebTransport completely.
Bakry and Mysk shared their findings with the Tor Project and the Onion Browser team. They also built a testing page at leaks.psylo.app so users can check their own setup.
What Users Can Do Now
Psylo already responded to the discovery. Version 1.3.1 blocks DNS-prefetch requests by default. It also switches off WebAuthn and WebTransport automatically. Users who need those features can still turn them back on for specific browsing profiles.
Other proxy-based browsers have not announced fixes yet. Users who rely on Tor’s iOS app or similar tools should watch for updates closely.
Anyone using a privacy browser on iPhone or Mac should check the leaks.psylo.app test tool. It shows whether a device’s real network details are currently exposed.
Turning off features like WebAuthn or WebTransport can reduce risk while waiting for a permanent fix. Closing unused tabs and avoiding unfamiliar sites also lowers exposure.
Privacy tools work best when every layer holds up. This discovery is a reminder that even trusted systems can carry hidden gaps. Staying updated on app patches remains the simplest defense for now.
The research also revealed that these WebKit flaws affect iCloud Private Relay and iOS browsers using Apple’s mandatory WebKit engine, exposing users’ real IPs through DNS prefetching, WebAuthn passkey requests, and WebTransport connections.
