Apple requires all browsers to use WebKit on iPhone, so a report suggests every browser is affected by three separate leaks that can hand off information around a proxy or iCloud Private Relay.
When users install proxy browsers or Tor, they expect absolute privacy while navigating the web. However, one developer has discovered that three separate data leaks can occur while using WebKit browsers on iOS or macOS.
According to the Mysk blog, DNS prefetching, WebAuthn for Passkeys, and WebTransport can all reveal data about the user in spite of proxy use or iCloud Private Relay. Tor browsers, proxy apps, and Safari are affected, but VPNs are not since they're acting at a system level to encrypt all traffic.
Of course the developer works on the Psylo app and has shared that all three vulnerabilities are fixed in the latest update. It required turning off the features, which are useful to have, and users will need to manage them on a per-site basis within the app.
The blog shared exactly how each of the three WebKit leaks are occuring:
- DNS prefetching: data leak exposed in iOS 26 resolves hostnames through the normal DNS path instead of proxy
- WebAuthn: introduced in iOS 18, Passkey validation file fetched from device revealing IP address
- WebTransport: active since iOS 26.4, opens a direct HTTP/3 connection exposing the real IP address
Each system is meant to help the user with speed of access and convenience, but they have inadvertently affected security. There is only one exception, and that's Onion Browser's "Silver" security level that makes WebKit configure with Lockdown Mode, so that specifically is unaffected by the WebTransport data leak.
The leaks were discovered after a Psylo user reported a DNS leak and the investigation uncovered all three problems. Users can test the leaks using a proof-of-concept website provided by the developer.
Apple will have to address all three WebKit issues in a future update, though it may take time. Now that the issue has been shared publicly, it may accelerate a fix from Apple.
Users need not take action beyond being aware that proxies and Tor alone may not hide every detail about themselves. The use of a VPN will ensure no data is shared outside of the device.
