IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

Summary#

Our proof-of-concept website leaks.psylo.app that detects the leaks

WebKit-based browsers connected iOS and macOS tin beryllium built to way each web postulation done proxy servers. This is really each proxy browsers activity connected iOS, including iOS Tor browsers and our ain browser, Psylo. Every web relationship a web page makes is expected to travel done the configured proxy, truthful websites only ever spot the proxy’s IP address. We recovered 3 WebKit features that bypass the proxy configuration and nonstop postulation straight from the instrumentality instead:

• DNS prefetching resolves hostnames done the device’s normal DNS path, which reveals the user’s existent DNS servers alternatively of the proxy’s. Available since iOS 26.0.
• WebAuthn Related Origin Requests make the operating system’s credential work fetch a validation record straight from the device. This exposes the device’s existent IP address. Available since iOS 18.0.
• WebTransport opens a nonstop HTTP/3 relationship and bypasses the proxy, which besides exposes the device’s existent IP address. Available since iOS 26.4.

These leaks besides effect Apple’s iCloud Private Relay. It must beryllium noted that VPNs are not affected, since they passageway the device’s full web postulation astatine the strategy level.

We’ve reached retired to the Tor Project and the developers of Onion Browser connected iOS astir these issues.

To trial the leaks, you tin sojourn our proof-of-concept website astatine leaks.psylo.app.

Fixed successful Psylo 1.3.1: Psylo now blocks dns-prefetch hints and disables WebTransport and WebAuthn by default. For websites that genuinely request these features, each 1 tin beryllium re-enabled done per-silo toggles. This definitive opt-in keeps the privateness trade-offs successful the user’s hands. See Mitigations Introduced successful Psylo 1.3.1 for details.

Background#

Proxy Configuration connected iOS and macOS#

Introduced successful iOS 17 and macOS 14, WKWebsiteDataStore.proxyConfigurations allows WebKit-based browsers way each of their ain web postulation done proxy servers astatine the exertion level. This API is the instauration of proxy browsers connected iOS: each web relationship a web page makes is expected to travel done the configured proxy, truthful websites only ever spot the proxy’s IP address.

DNS Leak Reported by a Psylo User#

This investigation started pinch a bug study from a Psylo personification who noticed DNS leaks erstwhile visiting only definite websites, and we instantly started looking into it. Psylo routes each postulation from each silo done the Mysk Private Proxy Network (or the user’s ain configured civilization proxy), truthful DNS queries should each originate from the proxy server and ne'er from the device. It besides seemed overseas that this only affected immoderate websites, and not all.

As we dug deeper, we recovered the root of the DNS leaks, positive 2 much leaks that really uncover the device’s existent IP address. All 3 leaks unrecorded successful WebKit, wherever they bypass the proxy settings provided by WKWebsiteDataStore.proxyConfigurations. Since Apple’s App Store argumentation requires each iOS browser to usage WebKit, immoderate iOS browser that relies connected this API for proxying is affected, including each iOS Tor browsers and Psylo. These leaks are besides coming successful Apple’s iCloud Private Relay. VPNs, connected the different hand, are not affected by these issues, since the device’s full web postulation is tunneled done the VPN astatine the strategy level.

iCloud Private Relay#

iCloud Private Relay is Apple’s privateness characteristic for iCloud+ subscribers. When enabled, it proxies Safari’s (and only Safari’s) web postulation and DNS queries done a two-hop relay, designed truthful that nary azygous party, not moreover Apple, tin spot some who you are and which sites you visit. As it turns out, each 3 leaks described successful this article hap extracurricular WebKit’s modular page-loading process, meaning Private Relay is susceptible to the aforesaid leaks.

1. DNS Prefetching#

DNS prefetching lets a website inquire the browser to resoluteness a hostname earlier it’s needed. So erstwhile later it needs to link to that hostname, the lookup is already done and the relationship starts faster. This is done done a <link rel="dns-prefetch"> HTML tag.

When a page includes that tag, WebKit resolves the hostname done the device’s normal DNS path, sloppy of immoderate proxy group by the browser done WKWebsiteDataStore.proxyConfigurations. A page tin embed unsocial per-visitor hostnames successful these tags, past watch the queries get astatine its ain charismatic DNS server from the visitor’s existent web alternatively than the proxy’s.

This was the leak down the original personification report, and it explains why only immoderate websites triggered it: without prefetch tags connected the page, WebKit doesn’t execute this DNS lookup.

Private Relay doesn’t drawback this one. It usually proxies Safari’s DNS queries, but these prefetch lookups skip it. The query reaches the charismatic server from the device’s existent web moreover pinch Private Relay enabled.

Desktop Safari has supported <link rel="dns-prefetch"> since Safari 5, but iOS ignored it until iOS 26.0 (September 2025), erstwhile WebKit enabled it successful the aforesaid alteration that removed iOS’s older, implicit speculative DNS prefetching (bug 285744, 290327@main; browser-compat data). That resolver had been rewritten the twelvemonth before, to support hostnames retired of strategy logs during backstage browsing (bug 272190, 279199@main).

WebAuthn is the web modular down passkeys. A passkey is usually bound to a azygous domain, but Related Origin Requests fto an statement usage 1 passkey crossed a mini group of domains it owns.

To make that work, erstwhile a page requests a credential whose rpId differs from its ain origin, the customer first fetches https://<rpId>/.well-known/webauthn, a JSON record listing which origins whitethorn usage that rpId.

That validation fetch doesn’t travel from the browser’s web stack. WebKit hands WebAuthn ceremonies to the operating system’s credential service, which issues the HTTPS petition itself, straight from the instrumentality and unaware of immoderate proxy the big app configured. A page tin group rpId to a big of its choosing, and the fetch fires moreover without personification interaction: pinch mediation: "conditional" and nary UI ever appears.

The aforesaid reasoning applies to iCloud Private Relay. Because the fetch is issued by the operating system’s credential work alternatively than by Safari, it ne'er enters Private Relay’s proxied path. The destination server sees the device’s existent IP reside either way.

Apple announced the characteristic for iOS 18.0 / Safari 18.0 (September 2024) successful WebKit Features successful Safari 18.0. WebKit’s half of the plumbing landed earlier that twelvemonth (bug 268426, 274592@main) and moreover shipped, inert, successful iOS 17.4; the strategy constituent that performs the fetch only gained support successful 18.0.

3. WebTransport#

WebTransport is simply a low-latency replacement to WebSocket. It runs complete HTTP/3 and QUIC, offers aggregate independent streams positive unreliable datagram delivery, and tin autumn backmost to HTTP/2 wherever QUIC is unavailable.

Calling caller WebTransport(url) opens a QUIC relationship consecutive from the device. WebKit builds the relationship pinch its ain web parameters and ne'er offers it the session’s proxy, truthful the server sees the device’s existent IP reside alternatively of the proxy’s.

Private Relay doesn’t thief present either. WebKit builds the relationship extracurricular the web postulation that Private Relay proxies, truthful a WebTransport server learns the device’s existent IP reside moreover pinch Private Relay enabled.

There is 1 exception: Onion Browser’s “Silver” information level configures WebKit pinch Lockdown Mode, which disables WebTransport entirely, truthful Onion Browser users astatine the Silver level are not affected by this peculiar leak.

First traces of the API appeared successful 2023 (bug 260810, 267408@main) but sat abnormal until December 2025, erstwhile it was switched connected for platforms pinch capable Network.framework support (bug 303453, 303860@main). It shipped publically successful iOS 26.4 (March 2026); spot WebKit Features for Safari 26.4 and the Safari 26.4 Release Notes.

Mitigations Introduced successful Psylo 1.3.1#

We’ve addressed each 3 leaks successful Psylo 1.3.1:

• Psylo blocks dns-prefetch hints, truthful a page tin nary longer make your instrumentality resoluteness attacker-controlled hostnames.
• WebTransport is abnormal by default.
• WebAuthn is abnormal by default.

Passkeys and WebTransport person morganatic uses, truthful some tin beryllium re-enabled astatine immoderate clip done per-silo toggles. This keeps Psylo leak-free retired of the box, while users who request 1 of these features connected a fixed tract tin opt successful explicitly, pinch a clear knowing of the trade-off.