-
Security researchers say WebKit’s passkey feature may reveal a user’s real IP address, even when using privacy tools on iPhones and iPads.
-
According to the post, the issue could affect all iOS browsers that depend on proxy connections, including Psylo, Onion Browser, and Tor-based browsers.
-
Psylo released version 1.3.1 to reduce the risk and launched a browser testing tool that checks for IP and DNS leaks.
People use proxy browsers to keep their internet activity private. These browsers help hide a user’s real IP address by sending internet traffic through another server. Many iPhone and iPad users also rely on Apple’s iCloud Private Relay for the same reason.
However, security researchers behind the privacy-focused browser Psylo say that protection may not always work as expected.
According to a security bulletin published by Psylo on X, WebKit’s handling of passkeys may expose a user’s real IP address instead of keeping it hidden.
The team said this behavior could affect every iOS browser because Apple requires all browsers on iPhones and iPads to use the WebKit browser engine. According to the post, this means browsers that depend on proxy connections could also be affected.
Researchers Link the Issue to WebKit
According to the post, the reported behavior is not limited to Psylo alone. The researchers said other browsers that depend on proxy services or the Tor network could face the same problem.
They specifically mentioned Onion Browser and other privacy-focused browsers that rely on proxy connections to hide a user’s identity.
If a website takes advantage of this behavior, it could discover a visitor’s real IP address instead of the protected one. That could weaken the privacy these browsers are designed to provide.
Security researcher Mysk, who co-founded Psylo, shared more details in a follow-up post on X. According to the post, the problem comes from WebKit itself rather than Psylo’s software.
The researcher explained that because every iOS browser must use WebKit, any browser that depends on proxy connections to hide a user’s IP address could experience the same behavior.
The report also raises questions for people who depend on privacy tools while browsing the web. Apple’s iCloud Private Relay is designed to hide a user’s IP address by sending internet traffic through a two-step relay system.
According to the post, WebKit’s handling of passkeys may allow some traffic to bypass those protections under certain conditions.
Psylo Releases an Update and Leak Testing Tool
Psylo responded by releasing version 1.3.1 of its browser. According to the post, the new version includes protections that stop WebKit’s passkey-related behavior from bypassing the browser’s proxy connection. The update aims to reduce the risk of a user’s real IP address becoming visible while using Psylo.
The developers also introduced an online testing tool that lets users check whether their browser is leaking IP or DNS information. According to the post, the service helps users confirm whether their browser’s privacy protections are working correctly. Users can test their browser by visiting Psylo’s Browser Leak Test at https://leaks.psylo.app.
Apple Has Not Responded Publicly
At the time of writing, Apple has not publicly commented on the reported behavior. According to the information provided, the company has not published a security advisory or assigned a CVE to the issue.
The report also notes that no major cybersecurity or technology publication has independently covered the disclosure so far. As a result, the findings currently come from Psylo’s security bulletin and follow-up posts shared by Mysk on X.
Psylo advised its users to install version 1.3.1 to receive the new protections. According to the post, users of other iOS browsers that rely on proxy connections should watch for updates or guidance from their browser developers until Apple addresses the reported WebKit behavior.
These privacy concerns are part of a larger trend; researchers have also identified attacks on Google Password Manager’s synced passkeys, where malware on Windows devices can bypass user verification or extract master encryption keys.
