WebKit Flaws Bypass iCloud Private Relay and Proxy Browsers on iOS and macOS

Researchers from Mysk have identified three vulnerabilities in WebKit on iOS and macOS that allow websites to bypass proxy configurations and Apple’s iCloud Private Relay. These leaks expose a user's real IP address and DNS servers, undermining the core privacy promises of the platform's browsing architecture.

The vulnerabilities stem from specific WebKit features that operate outside the standard page-loading network stack. According to the Mysk research team, every network connection a web page makes is supposed to flow through the configured proxy so that websites only see the proxy’s IP address. However, three specific features bypass this configuration and send traffic directly from the device.

One leak occurs via DNS prefetching, introduced in iOS 26, which resolves hostnames through the device's normal DNS path rather than the proxy. A second vulnerability involves WebAuthn Related Origin Requests, introduced in iOS 18, which triggers the OS credential service to fetch validation files directly from the device. Finally, WebTransport, shipped in iOS 26.4, opens direct HTTP/3 QUIC connections that bypass session proxy configurations entirely.

These leaks are systemic because Apple mandates that all browsers on iOS use the WebKit engine. Consequently, every proxy-based browser on the platform, including iOS Tor browsers, is susceptible. Privacy-focused browsers typically rely on the `WKWebsiteDataStore.proxyConfigurations` API to route traffic, but these specific features communicate directly with the internet, creating a critical failure for users attempting to mask their identity or location.

For the industry, this highlights a recurring tension between the introduction of new web capabilities and the maintenance of strict privacy boundaries. The fact that these leaks persist across both iCloud Private Relay and third-party proxy browsers suggests a fundamental gap in how WebKit handles non-standard network requests. While system-wide VPNs remain unaffected because they tunnel all network traffic at the OS level, users relying on browser-level privacy tools are left exposed.

Currently, the only known mitigations are manual blocks implemented by specific developers or the use of a system-wide VPN. Notably, the Onion Browser's 'Silver' security level is unaffected by the WebTransport leak because it utilizes Lockdown Mode to disable the feature. Users and developers are now waiting to see if Apple will patch these leaks in future WebKit updates or if further manual workarounds will be required to secure proxy-based browsing on iOS.