WebKit Flaw Exposes iOS and macOS Users: Proxies and iCloud Private Relay Bypassed

A newly discovered WebKit data leak is exposing the real IP addresses and browsing data of iOS and macOS users, completely bypassing proxies and iCloud Private Relay. Because Apple mandates the use of its WebKit engine for all browsers on the iPhone, this vulnerability affects Safari, Tor, and third-party proxy apps alike.

According to a report from the security researchers at the Mysk blog, users who rely on proxy browsers for absolute privacy are currently at risk. The investigation, initially sparked by a user of the Psylo app reporting a DNS leak, uncovered three distinct vulnerabilities within WebKit. These systems were originally designed to improve access speed and user convenience, but they inadvertently compromise security by routing specific traffic outside of encrypted proxy tunnels.

The Mysk blog detailed exactly how these three WebKit leaks are occurring across Apple's operating systems. Users can test these leaks using a proof-of-concept website provided by the developer.

• DNS prefetching: Exposed in iOS 26, this flaw resolves hostnames through the normal DNS path instead of routing them through the active proxy.
• WebAuthn: Introduced in iOS 18, the Passkey validation file is fetched directly from the device, which reveals the user's real IP address.
• WebTransport: Active since iOS 26.4, this feature opens a direct HTTP/3 connection, exposing the real IP address regardless of proxy settings.

Since Apple has not yet released an official security patch to address these WebKit issues, users must take alternative measures to secure their browsing data.

• Use a System-Level VPN: Unlike proxies, Virtual Private Networks (VPNs) encrypt all traffic at the system level and are completely unaffected by these WebKit leaks. A VPN ensures no data is shared outside of the device.
• Update Specific Apps: The developer of the Psylo app has already patched these vulnerabilities in their latest update by disabling the offending features, allowing users to manage them on a per-site basis.
• Enable Lockdown Mode: Users of the Onion Browser can switch to the "Silver" security level. This configures WebKit to use Lockdown Mode, which specifically neutralizes the WebTransport data leak.

This vulnerability highlights the inherent risk of Apple's strict WebKit mandate on iOS. By forcing every browser - from Chrome to privacy-focused Tor clients - to use the same underlying rendering engine, Apple creates a single point of failure. When a flaw like this emerges, it doesn't just affect Safari; it compromises the entire ecosystem's privacy tools.

While Apple will likely patch these specific leaks in an upcoming iOS update, the incident proves that relying solely on in-browser proxies or iCloud Private Relay is insufficient for users requiring absolute anonymity. Until the WebKit monopoly is fully dismantled globally, system-level VPNs remain the only foolproof shield for iPhone users navigating sensitive environments.