IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Technical deep-dive on WebKit proxy leaks affecting privacy, highly relevant to cloud and infrastructure engineers.
Researchers discovered three WebKit features—DNS prefetching (iOS 26.0+), WebAuthn Related Origin Requests (iOS 18.0+), and WebTransport (iOS 26.4+)—that bypass proxy configurations set via WKWebsiteDataStore.proxyConfigurations, leaking real IPs and DNS servers from iOS and macOS devices. This affects all WebKit-based proxy browsers (including Tor Browser for iOS and Psylo) and Apple's iCloud Private Relay, but not system-level VPNs. Psylo 1.3.1 mitigates all three by blocking dns-prefetch hints and disabling WebTransport and WebAuthn by default, with per-silo opt-in toggles.