- Researchers Talal Haj Bakry and Tommy Mysk found three WebKit flaws leaking real IPs despite iCloud Private Relay
- DNS prefetching, WebAuthn origin requests, and WebTransport bypass proxy settings, exposing users across all Apple browsers
- Tor and Psylo browsers issued fixes; Apple has not confirmed a patch but is reviewing the report
WebKit, Apple’s engine that powers all web browsers in its ecosystem, contained multiple flaws that helped leak the IP addresses of users who paid to keep them hidden.
This is according to security researchers Talal Haj Bakry and Tommy Mysk who noted they had found “three WebKit features that bypass the proxy configuration and send traffic directly from the device instead,” they wrote.
“DNS prefetching resolves hostnames through the device’s normal DNS path, which reveals the user’s real DNS servers instead of the proxy’s. Available since iOS 26.0; WebAuthn Related Origin Requests make the operating system’s credential service fetch a validation file directly from the device. This exposes the device’s real IP address. Available since iOS 18.0; WebTransport opens a direct HTTP/3 connection and bypasses the proxy, which also exposes the device’s real IP address. Available since iOS 26.4," the researchers said.
Private Relay
While the bugs are in WebKit, the leaks come via Private Relay - a privacy feature available with iCloud+ that hides a user’s IP address and encrypts Safari web traffic. Private Relay does not work like a VPN, and does not mask the traffic flowing through other apps and programs - it just handles browser traffic.
Since WebKit is mandatory for all browsers running in Apple’s ecosystem, the vulnerability affects all of them. Some, including Tor and Mysk’s very own Psylo browsers, have already issued fixes.
Apple, on the other hand, has not yet confirmed a fix, or even that it was working on one. It did say, according to 404 Media, that it was looking into the research report.
The researchers built a dedicated website where users can check if Private Relay is working as intended or still leaking the actual IP address into the wild.
➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.