WebKit Leaks Real IP and DNS in Proxy Browsers and iCloud Private Relay
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
WebKit-based browsers on iOS and macOS can route traffic through proxies, but three features—DNS prefetching, WebAuthn Related Origin Requests, and WebTransport—bypass the proxy, exposing users' real IP and DNS. These leaks affect all proxy browsers, including Tor browsers, and Apple's iCloud Private Relay. Psylo 1.3.1 fixes them by blocking dns-prefetch and disabling WebTransport and WebAuthn by default.
Every network connection a web page makes is supposed to flow through the configured proxy, so websites only ever see the proxy’s IP address.
- rickstanley
When I go to https://leaks.psylo.app on "Possible IP leaks" side I see only "WebAuthn" with my real IP and, occasionally, WebTransport with an incorrect IP. For "HTTPS Traffic" it always show some other relay. Using Safari 26.5
I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
- bernd289
There was at least one other Private Relay issue that doesn’t seem to have received much public attention.
I found and reported an IP leak to Apple in December 2025. The issue was caused by an EDNS Client Subnet (ECS) configuration problem in Akamai’s infrastructure, which could result in the client’s real IP being forwarded when it shouldn’t have been.
Apple confirmed the fix at the end of March 2026, and then I unexpectedly received a $5,000 Security Bounty in July.
- irusensei
Apple private relay is very flawed but on the other hand most sites that view connections originating from VPN as suspicious seem to be ok with Apple Private Relay. If you have VPN on your router private relay on top of it could be a good way to do ip address laundering.
- solenoid0937
https://psylo.app/legal/privacy/
Lots of these seem unnecessary, especially collecting "bandwidth usage" and "timestamps".
- exabrial
I love iCloud private relay, but I need a way to turn it off. A command line utility would be amazing, along with the ability to turn off/on DNS-over-HTTP.