Particle.news
Download on the App Store
12 ARTICLES
·
yesterday

WebKit Flaws Reveal Real IP Addresses Despite iCloud Private Relay

Researchers disclosed three WebKit features that bypass Safari’s proxying, exposing device IPs to websites.

Image
Image
Laptop on a library desk shows a horizontal data flow diagram: device → Wi‑Fi → servers → servers with security icons.
A WebKit privacy leak can expose your iPhone or Mac’s real IP address even when using proxy browsers or iCloud Private Relay.

Overview

  • Researchers Tommy Mysk and Talal Haj Bakry published a proof‑of‑concept on Aug. 4–5 that shows DNS prefetching, WebAuthn/passkey related‑origin requests, and WebTransport can leak a user’s real IP address and DNS data despite Private Relay.
  • The passkey issue happens because the device’s credential service issues validation requests outside the browser proxy, so those requests do not travel through Private Relay and reveal the device IP.
  • Because Apple requires all iOS browsers to use WebKit, the flaws affect Safari and many third‑party browsers on iPhone and iPad, and they can also undermine some Tor/proxy apps that rely on WebKit.
  • Psylo, the privacy browser run by one researcher, released mitigations that disable the implicated features per site, and security outlets reproduced the leaks; Apple says it is investigating but has given no public patch timeline.
  • Practical protections include using a system‑level VPN to route all device traffic, testing devices on the researchers’ checker site, and watching for WebKit or OS updates because fixes may require changes to WebKit or operating‑system behavior; the finding follows a July report of another iCloud+ privacy failure.