IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
Researchers have identified three WebKit features that allow web traffic to bypass proxy configurations on iOS and macOS, potentially leaking IP and DNS information. The vulnerability affects proxy browsers and Apple's iCloud Private Relay, though standard VPNs remain unaffected.
Why it matters
This discovery exposes a significant privacy flaw for users relying on proxy-based anonymity tools on Apple devices, necessitating updates to browser software.
Psylo is our privacy-first browser for iOS and iPadOS, with a built-in proxy network, per-tab isolated web sessions, and anti-fingerprinting. Using it helps fund more work like this.
WebKit-based browsers on iOS and macOS can be built to route all web traffic through proxy servers. This is how all proxy browsers work on iOS, including iOS Tor browsers and our own browser, Psylo. Every network connection a web page makes is supposed to flow through the configured proxy, so websites only ever see the proxy's IP address. We found three WebKit features that bypass the proxy configuration and send traffic directly from the device instead:
These leaks also impact Apple's iCloud Private Relay. It must be noted that VPNs are not affected, since they tunnel the device's entire network traffic at the system level.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in