Security researchers have uncovered three critical WebKit vulnerabilities that expose users’ real IP addresses and DNS information—even when Apple’s iCloud Private Relay or proxy services are enabled.
Because the flaws directly from Apple’s WebKit engine, the issue affects Safari, iOS third-party browsers, and privacy-focused tools like OnionBrowser (Tor on iOS) that rely on WebKit proxies.
Key Highlights – iCloud Private Relay
- Passkey & WebAuthn Leak: Websites supporting or simulating passkeys force the OS credential service to fetch validation files directly from the device, bypassing proxy routes and revealing the real IP address without triggering any user prompt.
- Three Affected WebKit Features: DNS prefetching, WebAuthn related origin requests, and WebTransport protocols all bypass configured proxies to send raw device requests.
- Impact Beyond Safari: Because Apple mandates WebKit for iOS browsers, alternative browsers like OnionBrowser (Tor) and Psylo suffer from identical leaks.
- VPNs Unaffected: Traditional system-wide VPNs remain secure, as they operate at the OS level to encrypt all device traffic rather than relying on WebKit’s proxy path.
What is iCloud Private Relay?
iCloud Private Relay is an internet privacy service built into Apple’s iCloud+ subscription designed to protect web browsing traffic in Safari. Unlike a traditional system-wide VPN, Private Relay uses a dual-hop architecture where outbound web requests are routed through two separate, independent relays: an ingress server operated by Apple and an egress server run by a third-party partner (such as Cloudflare or Fastly).
The first relay sees the user’s real IP address but cannot read the destination website due to DNS encryption, while the second relay generates a temporary, localized IP address and decrypts the target site without ever knowing the user’s true identity. This structure prevents any single entity—including Apple or network providers—from linking a user’s identity to their browsing activity.
How the 3 WebKit Flaws Leak Data
1. WebAuthn Passkey Fetching (Primary Threat)
- The Mechanism: When a web page includes Passkey support (using WebAuthn standards), WebKit passes the request to the operating system’s credential manager.
- The Leak: The OS credential manager issues the HTTPS request directly from the device, completely unaware of Safari’s or WebKit’s proxy settings.
- Silent Exploitation: Attackers can invoke `mediation: “conditional”` on a site to trigger the background request silently—exposing the user’s real IP address without displaying any UI or passkey prompt.
2. DNS Prefetching
- The Mechanism: WebKit attempts to speed up web navigation by pre-resolving hostnames.
- The Leak: Instead of routing lookups through the proxy server, WebKit sends queries via the device’s native DNS path, exposing the user’s authentic DNS server details to eavesdroppers.
3. WebTransport Connections
- The Mechanism: Used for fast bidirectional communication over HTTP/3.
- The Leak: WebTransport creates direct HTTP/3 connections that bypass proxy configurations entirely, revealing the device’s public IP address.
What Users Should Do
Apple acknowledged the report and confirmed an active investigation into the underlying WebKit behavior. In the meantime:
1. Use a System-Wide VPN: Unlike browser-level proxies or Private Relay, a system-level VPN encrypts all network interfaces on the device, ensuring WebKit processes cannot bypass the secure tunnel.
2. Update Independent iOS Browsers: Independent browser developers (such as Psylo in version 1.3.1) have released updates that disable these WebKit features on a per-site basis to stop leaks.
3. Test Your Device: Researchers have made a public proof-of-concept tool available for users to test if their current browser configuration is leaking network details.
