WebKit‑based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, yet three WebKit features bypass the proxy and reveal the device’s real IP address, impacting Safari and Apple’s iCloud Private Relay.

Proxy routing was introduced in iOS 17 and macOS 14 via the WKWebsiteDataStore.proxyConfigurations API, which requires browsers to send all network connections through the configured proxy so that websites see only the proxy’s IP address.

DNS prefetching, available since iOS 26.0, resolves hostnames through the device’s normal DNS path, exposing the user’s DNS servers instead of the proxy’s.

WebAuthn Related Origin Requests, introduced in iOS 18.0, cause the operating system’s credential service to fetch validation data directly from the device, revealing the real IP address.

WebTransport, enabled in iOS 26.4, creates direct QUIC connections that bypass the proxy, also exposing the device’s real IP address.

The same vulnerabilities affect iCloud Private Relay because the proxying occurs outside the Private Relay path.

All iOS browsers that rely on WebKit, including Tor browsers and the Psylo browser, are affected, while VPNs are not, since they encapsulate all traffic at the system level.

Psylo version 1.3.1 blocks DNS prefetch hints, disables WebTransport by default, and disables WebAuthn by default; users can re‑enable the features through per‑silo toggles if needed.

The fix keeps the privacy trade‑offs under user control, but broader WebKit updates are required to eliminate the leaks across all browsers.