WebKit privacy leak leaves iPhone and Mac users exposed

Дата публикации: 05-08-2026 16:37:40

A newly discovered WebKit privacy leak bypasses proxy protection and iCloud Private Relay, exposing your real IP addresses and DNS data.
(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Основное содержимое страницы с новостью.

Three recently discovered WebKit privacy leaks expose users’ real IP addresses on iPhone and Mac, even when they use a proxy browser or iCloud Private Relay, according to a new report.

This would mean Apple’s trusted privacy tools aren’t working as advertised. If you’ve relied on proxy browsers for anonymity or iCloud Private Relay for privacy, that protection apparently has some serious gaps.

How the WebKit Privacy leaks work

Apple has spent years making privacy a defining feature of the iPhone, promoting technologies like iCloud Private Relay as safeguards against online tracking. These newly disclosed WebKit flaws show that privacy protections are only as strong as the browser engine beneath them.

According to cybersecurity researchers and app developers at Mysk, the WebKit privacy leak consists of three components, each exposing different data.

• DNS prefetching resolves hostnames using your device’s normal DNS path, not a proxy — revealing your real DNS servers to websites tracking the lookups. The feature shipped in iOS 26.0.
• Introduced in iOS 18, WebAuthn Related Origin Requests handle passkey validation across related domains. When a website requests your credentials, the operating system fetches a validation file directly from your device. In the process, it exposes your real IP address.
• Active since iOS 26.4, WebTransport opens direct HTTP/3 connections, bypassing proxies entirely and sending traffic straight from your device to any server.

All iOS browsers are affected

Because Apple requires that every browser on iOS must use WebKit, a vulnerability at that layer doesn’t just affect Safari. It can undermine the privacy promises of nearly every browser on the platform. And that raises fresh questions about Apple’s browser restrictions and whether its privacy architecture is vulnerable to a single point of failure.

Because of Apple’s mandate, the WebKit leaks affect Tor apps and proxy browsers in addition to Safari itself. And despite Apple’s privacy-focused design, iCloud Private Relay also suffers from these leaks.

However, virtual private networks remain unaffected. Since VPNs operate at the system level, traffic remains encrypted, preventing the WebKit leaks from bypassing them.

• See also: How to improve security in Safari Private Browsing

How the WebKit privacy leaks were discovered

Mysk, developer of the privacy-focused Psylo web browser, says the WebKit privacy leak was uncovered after a user complained about unusual DNS queries. On further investigation, Mysk discovered the three vulnerabilities in Apple’s browser engine.

The Mysk researchers created a proof-of-concept website to show each leak works and notified the Tor Project and iOS Tor browser developers about the leak.

Passkey and Tor Browsers have one exception

Onion Browser’s highest security settings — Silver — configure WebKit with LockDown Mode, which completely disables WebTransport. This means Onion Browser users at that security level avoid the WebTransport portion of the WebKit privacy leak.

But other proxy browsers, Tor apps and Safari users remain vulnerable to all three leaks.

What Apple needs to do

Apple needs to address the WebKit privacy leak in a future iOS and macOS update. The company is yet to announce any timeline for fixes, though security researchers have formally notified Apple of the vulnerabilities.

For maximum protection, combine a VPN with browser privacy settings. This creates multiple security layers, with system-level VPN blocking these leaks entirely.

• See also: New price cut: Get FastestVPN on 10 devices, just $22.50 for life

You can test whether you are affected by visiting the proof-of-concept website created by the Myst researchers, which detects all these leaks.

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	Privacy browsers on iOS and iCloud Private Relay are leaking your IP and DNS	0	9.23	06-08-2026
2	Apple faces Hide My Email lawsuit over privacy flaw it allegedly failed to fix	-2	6	17-07-2026
3	На Apple подали в суд из-за уязвимости iCloud Private Relay: сайты могли узнать реальный IP-адрес пользователей	0	10.57	11-08-2026
4	iCloud Private Relay might be leaking your real IP address, researchers say	0	8.31	05-08-2026
5	Уязвимость в iCloud Private Relay раскрывает реальный IP-адрес	-1	10.98	07-08-2026
6	Защита Apple дала сбой: iPhone может сливать ваш IP-адрес	0	14.49	06-08-2026
7	Apple’s Hide My Email has been leaking real addresses for a year	-5	7	01-07-2026
8	Функция скрытия IP-адреса у Apple работает не всегда	0	11.19	07-08-2026
9	Apple faces fraud allegation over iCloud Private Relay failures	0	22.53	11-08-2026
10	8 new features in Safari in iOS 27 that make browsing better	5	5	22-06-2026

Классификация: . Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 23.94. Источник: www.cultofmac.com.