Security researchers Talal Haj Bakry and Tommy Mysk have found three bugs in Apple’s WebKit, the engine behind every browser on iOS. They say WebKit leaks your real network info even when you’re using a proxy browser or Apple’s iCloud Private Relay.
Privacy browsers on iOS work by routing everything through a proxy server, so sites only see the proxy’s IP instead of yours. Private Relay does something similar for Safari, and the researchers found three features that skip that entirely and connect straight out from your device.
The first is DNS prefetching, a speed trick where a page asks your browser to look up an address early. On iOS that lookup goes through your device’s normal DNS, so a site can plant a unique address and watch the request arrive from your real network.
The next bug involves passkeys, which Bakry and Mysk explain that when a site uses one shared across related domains, iOS fetches a verification file itself, unaware any proxy exists. It can fire without you touching anything. Another bug is related to WebTransport, which opens a connection directly from your device and hands over your real IP.
Every iOS browser is affected because Apple’s App Store rules require them all to use WebKit. That includes iOS Tor browsers and the researchers’ own browser, Psylo. They’ve contacted the Tor Project and Onion Browser’s developers. Proper VPNs aren’t affected, since they tunnel everything at the system level.
“Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status “We’re planning to address the issue you reported.” and a fix is planned for Fall 2026,” said the Psylo team today, which agreed with a user that is it a sad state of affairs that they need to “bully” Apple into fixing this patch immediately.
All three are patched in their private web browser Psylo that debuted last year(version 1.3.1), and there’s a test page at leaks.psylo.app if you want to check yourself.
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
