Three WebKit features leak users' real IP and DNS past proxy browsers — iCloud Private Relay included

August 4, 2026. Talal Haj Bakry and Tommy Mysk, the security researchers behind the Psylo browser, published a discovery that undermines trust in proxy-based browsing on iOS and macOS. Three WebKit features — the mandatory rendering engine on iOS — bypass browser proxy configuration and expose the user’s real IP address and DNS servers. The same leaks affect Apple’s iCloud Private Relay.

The investigation began with a bug report from a Psylo user who noticed DNS leaks only on certain websites. The problem turned out to be systemic.

Why this matters

WKWebsiteDataStore.proxyConfigurations is the API introduced in iOS 17 and macOS 14 that lets WebKit-based browsers route all their web traffic through proxy servers at the application level. It’s the foundation of every proxy browser on iOS, including Tor browsers and Psylo.

The API’s promise is straightforward: every network connection a web page makes must flow through the configured proxy. Websites should never see anything but the proxy’s IP address. The three discovered flaws break that promise in three distinct ways.

VPNs are not affected — they tunnel all device traffic at the system level. The problem is specific to WebKit application-level proxying, which includes iCloud Private Relay, itself an application-level proxy limited to Safari.

Leak #1: DNS Prefetching (since iOS 26.0)

DNS prefetching lets a website ask the browser to resolve a hostname before it’s needed, via a <link rel="dns-prefetch"> tag. The idea is legitimate: when the page later needs to connect to that host, the DNS resolution is already done and the connection starts faster.

The problem: when a page includes that tag, WebKit resolves the hostname through the device’s normal DNS path, completely ignoring any proxy configuration. A site can embed unique per-visitor hostnames in these tags, then watch the queries arrive at its authoritative DNS server from the visitor’s real network, not from the proxy.

This was the leak behind the original user report. Its intermittent nature is explained: only sites that use the dns-prefetch tag trigger the leak. The feature was ignored on iOS until iOS 26.0 (September 2025), when WebKit enabled it while removing the older implicit speculative DNS prefetching (WebKit bugs 285744, 290327@main).

iCloud Private Relay doesn’t block this leak. It normally proxies Safari’s DNS queries, but these prefetch lookups skip it. The authoritative DNS server sees the device’s real IP address even with Private Relay enabled.

Leak #2: WebAuthn Related Origin Requests (since iOS 18.0)

WebAuthn is the web standard behind passkeys. A passkey is normally bound to a single domain, but Related Origin Requests let an organization use one passkey across a small set of domains it owns.

The validation mechanism works like this: when a page requests a credential whose rpId differs from its own origin, the client first fetches https://<rpId>/.well-known/webauthn, a JSON file listing which origins are allowed to use that rpId.

That validation fetch doesn’t come from the browser’s network stack. WebKit hands WebAuthn ceremonies to the operating system’s credential service, which issues the HTTPS request directly from the device, unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires without user interaction: with mediation: "conditional", no UI ever appears.

The same reasoning applies to iCloud Private Relay. Because the fetch is issued by the OS credential service rather than Safari, it never enters Private Relay’s proxied path. The destination server sees the device’s real IP address either way.

Apple announced the feature for iOS 18.0 / Safari 18.0 (September 2024). WebKit’s half of the plumbing was ready as early as iOS 17.4, but the system component that performs the fetch only gained support in 18.0.

Leak #3: WebTransport (since iOS 26.4)

WebTransport is a low-latency alternative to WebSocket. It runs over HTTP/3 and QUIC, offers multiple independent streams plus unreliable datagram delivery, and falls back to HTTP/2 where QUIC is unavailable.

Calling new WebTransport(url) opens a QUIC connection straight from the device. WebKit builds the connection with its own network parameters and never offers it the session’s proxy. The server sees the device’s real IP address instead of the proxy’s.

Private Relay doesn’t help here either. WebKit builds the connection outside the web traffic that Private Relay proxies, so a WebTransport server learns the device’s real IP address even with Private Relay enabled.

A notable exception: Onion Browser at the “Silver” security level configures WebKit with Lockdown Mode, which disables WebTransport entirely. Onion Browser users at this level are not affected by this specific leak.

The API’s first traces appeared in 2023, but it sat disabled until December 2025, when it was switched on for platforms with sufficient Network.framework support. Public release came with iOS 26.4 (March 2026).

Mitigations in Psylo 1.3.1

The Mysk team fixed all three leaks in Psylo 1.3.1:

• dns-prefetch hints are blocked — a page can no longer force your device to resolve attacker-controlled hostnames.
• WebTransport is disabled by default.
• WebAuthn is disabled by default.

Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.

Verdict

If you use a proxy browser on iOS (Tor Browser, Onion Browser, Psylo, or any other), update immediately if a fix is available. If you rely on iCloud Private Relay to anonymize your browsing, be aware that these three vectors expose your real IP address and DNS servers — the protection level is lower than the documentation implies.

For iOS browser developers, Psylo’s three mitigations provide a template: block dns-prefetch, disable WebTransport and WebAuthn by default, offer per-site opt-in. For end users, the recommendation is unambiguous: if network anonymity is critical, use a VPN rather than an application-level proxy or Private Relay. A VPN operates at the system level and is not affected by these leaks.

References

• Mysk Blog, “IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay”, August 4, 2026 — https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
• Psylo Browser, leaks.psylo.app — leak demonstration website
• WebKit Bugzilla, bugs 285744, 290327@main — DNS prefetching enabled on iOS
• WebKit Bugzilla, bugs 268426, 274592@main — WebAuthn Related Origin Requests implementation
• WebKit Bugzilla, bugs 303453, 303860@main — WebTransport enabled