New WebKit Privacy Flaws Can Expose Real IP Addresses on iPhone and Mac

Security researchers have discovered three privacy risks in Apple’s WebKit browser engine that may expose the real IP address and DNS information of iPhone and Mac users.

The problems may affect people using WebKit-based proxy browsers, Tor browsers on iOS, Safari with iCloud Private Relay, and other apps that depend on WebKit’s proxy system.

Researchers Talal Haj Bakry and Tommy Mysk found that some WebKit features can send network requests directly from the device instead of routing them through the selected proxy.

Three WebKit Privacy Leaks Discovered

The researchers identified the following three leak methods:

DNS Prefetching

DNS prefetching helps websites load faster by resolving domain names before users open them.

However, WebKit may process these requests through the device’s normal DNS connection instead of the configured proxy. This could reveal the user’s real DNS service or internet network.

The feature has been available on iPhones since iOS 26.0.

WebAuthn Related Origin Requests

WebAuthn is the technology used for passkeys and password-free sign-ins.

During certain passkey checks, Apple’s operating system may download a verification file directly from a website. Because this request does not pass through the browser’s proxy, the website may see the device’s real IP address.

This behaviour has been available since iOS 18.0.

WebTransport

WebTransport provides fast browser communication using HTTP/3 and QUIC.

According to the researchers, WebTransport can create a direct connection from the device while ignoring the browser’s configured proxy. This may expose the user’s real IP address.

WebTransport became publicly available with iOS 26.4.

iCloud Private Relay May Also Be Affected

The researchers claim that all three methods can bypass Apple’s iCloud Private Relay in certain situations.

Private Relay is designed to hide a Safari user’s IP address and protect DNS requests. However, these connections reportedly happen outside the normal web traffic handled by Private Relay.

System-level VPN connections are not affected by these specific leaks because they route the device’s complete network traffic through the VPN.

The researchers have also contacted the Tor Project and the developers of Onion Browser about their findings.

Psylo, the privacy browser developed by the researchers, has addressed the problems in version 1.3.1 by blocking DNS prefetching and disabling WebTransport and WebAuthn by default.

Apple has not yet publicly announced a WebKit update specifically addressing all three reported privacy leaks.

Sources: Mysk Security Research, AppleInsider, Apple Developer Documentation, IT Home