Three recently discovered WebKit privacy leaks expose users’ real IP addresses on iPhone and Mac, even when they use a proxy browser or iCloud Private Relay, according to a new report.
This would mean Apple’s trusted privacy tools aren’t working as advertised. If you’ve relied on proxy browsers for anonymity or iCloud Private Relay for privacy, that protection apparently has some serious gaps.
How the WebKit Privacy leaks work
Apple has spent years making privacy a defining feature of the iPhone, promoting technologies like iCloud Private Relay as safeguards against online tracking. These newly disclosed WebKit flaws show that privacy protections are only as strong as the browser engine beneath them.
According to cybersecurity researchers and app developers at Mysk, the WebKit privacy leak consists of three components, each exposing different data.
- DNS prefetching resolves hostnames using your device’s normal DNS path, not a proxy — revealing your real DNS servers to websites tracking the lookups. The feature shipped in iOS 26.0.
- Introduced in iOS 18, WebAuthn Related Origin Requests handle passkey validation across related domains. When a website requests your credentials, the operating system fetches a validation file directly from your device. In the process, it exposes your real IP address.
- Active since iOS 26.4, WebTransport opens direct HTTP/3 connections, bypassing proxies entirely and sending traffic straight from your device to any server.
All iOS browsers are affected
Because Apple requires that every browser on iOS must use WebKit, a vulnerability at that layer doesn’t just affect Safari. It can undermine the privacy promises of nearly every browser on the platform. And that raises fresh questions about Apple’s browser restrictions and whether its privacy architecture is vulnerable to a single point of failure.
Because of Apple’s mandate, the WebKit leaks affect Tor apps and proxy browsers in addition to Safari itself. And despite Apple’s privacy-focused design, iCloud Private Relay also suffers from these leaks.
However, virtual private networks remain unaffected. Since VPNs operate at the system level, traffic remains encrypted, preventing the WebKit leaks from bypassing them.
How the WebKit privacy leaks were discovered
Mysk, developer of the privacy-focused Psylo web browser, says the WebKit privacy leak was uncovered after a user complained about unusual DNS queries. On further investigation, Mysk discovered the three vulnerabilities in Apple’s browser engine.
The Mysk researchers created a proof-of-concept website to show each leak works and notified the Tor Project and iOS Tor browser developers about the leak.
Passkey and Tor Browsers have one exception
Onion Browser’s highest security settings — Silver — configure WebKit with LockDown Mode, which completely disables WebTransport. This means Onion Browser users at that security level avoid the WebTransport portion of the WebKit privacy leak.
But other proxy browsers, Tor apps and Safari users remain vulnerable to all three leaks.
What Apple needs to do
Apple needs to address the WebKit privacy leak in a future iOS and macOS update. The company is yet to announce any timeline for fixes, though security researchers have formally notified Apple of the vulnerabilities.
For maximum protection, combine a VPN with browser privacy settings. This creates multiple security layers, with system-level VPN blocking these leaks entirely.
You can test whether you are affected by visiting the proof-of-concept website created by the Myst researchers, which detects all these leaks.
