06.08.2026
3 min
9
A flaw has been discovered in browsers on iOS and macOS that can expose users’ real IP addresses even when iCloud Private Relay or other built-in proxy protections are enabled. The issue stems from the way WebKit handles certain network requests, bypassing configured proxy settings and sending traffic directly. Device-wide VPNs are not affected by the vulnerability.
The issue was discovered by the Mysk team, which consists of developers Talal Haj Bakry and Tommy Mysk, known for building privacy-focused apps for Apple platforms. According to their findings, WebKit ignores proxy configurations in certain scenarios, allowing DNS requests and website connections to bypass the configured proxy and expose a user’s real IP address.
“Three WebKit features, DNS prefetching, WebAuthn related origin requests, and WebTransport, bypass the configured proxy and send traffic directly from the device, exposing the user’s real network. The same leaks also affect Apple’s iCloud Private Relay,” the Mysk team warned.
The researchers began investigating after users of the Psylo browser reported DNS leaks when visiting certain websites.
“We immediately started investigating it,” Tommy Mysk said.
Their analysis revealed that WebKit can expose a user’s real IP address in three different ways.
The first involves DNS Prefetch. This feature resolves domain names in advance to speed up page loading. However, WebKit sends these requests through the device’s regular DNS servers instead of the configured proxy, allowing websites to see the user’s real network information.
The second issue involves WebAuthn Related Origin Requests, a mechanism used to support Passkeys across multiple domains. These requests are handled by Apple’s system credential service rather than the browser itself, allowing them to bypass proxy settings. A malicious website could exploit this behavior by tricking the system into contacting a server controlled by an attacker, revealing the user’s real IP address.
The third issue affects WebTransport, a modern communication protocol introduced in iOS 26.4. It establishes HTTP/3 connections directly, bypassing the configured proxy. Browsers in the Onion family are not affected because WebTransport is disabled by default.
According to the researchers, the implications could be significant. Journalists, activists, politicians, and other users who rely on Apple’s built-in privacy protections may have unknowingly exposed their real IP addresses while browsing.
Following the discovery, the Mysk team released an update for its Psylo browser. The update disables DNS Prefetch, WebTransport, and WebAuthn by default. While this limits some browser functionality, it significantly improves user privacy.
“Passkeys and WebTransport have legitimate use cases, so both can be re-enabled at any time using per-slot switches,” Tommy Mysk explained.
The researchers also notified the Tor Project and the developers of Onion Browser for iOS, who are expected to release their own security updates.
According to Apple’s documentation, iCloud Private Relay, included with an iCloud+ subscription, is designed to hide users’ IP addresses, encrypt DNS requests, and route traffic through two independent relay servers. This ensures that no single party, including Apple, can identify both the user and the websites they visit. However, the new findings suggest that, due to the way WebKit handles certain network requests, the feature may not always provide the level of privacy Apple intends.
