Key Takeaways
- Apple’s iCloud Private Relay uses a two‑hop proxy to hide users’ IP addresses, but three WebKit features can bypass this proxy.
- DNS prefetching, WebAuthn Related Origin Requests, and WebTransport each cause Safari (and other WebKit‑based browsers) to send traffic directly, exposing the real IP.
- The leak works even when Private Relay is active and does not require user interaction or passkey usage; a malicious site only needs to trigger the WebKit APIs.
- A proof‑of‑concept site (leaks.psylo[.]app) lets users test whether their IP leaks; the issue also affects macOS and any WebKit‑based browser that relies on WebKit’s proxy APIs.
- Apple is investigating the report; similar privacy‑bypass flaws have been found in Private Relay before, indicating a recurring challenge in balancing convenience with strong anonymity.
Overview of iCloud Private Relay
iCloud Private Relay, launched with iOS 15 and iPadOS 15, is a privacy‑focused service available to iCloud+ subscribers. It routes Safari web traffic through two separate relays operated by Apple and a trusted partner, ensuring that neither endpoint can see both the user’s IP address and the destination website. By splitting the connection, the service aims to prevent any single third‑party—including Apple itself—from linking a request to its source and content. The design mirrors that of a VPN but adds an extra hop to strengthen anonymity. While primarily intended for Safari, the underlying proxy mechanism is exposed via WebKit’s configuration APIs, meaning any WebKit‑based browser on Apple platforms can inherit the same routing rules.
Discovery of the WebKit‑Based Bypass
Security researchers Talal Haj Bakry and Tommy Mysk identified that three specific WebKit features can circumvent the proxy configured by iCloud Private Relay. Their analysis showed that DNS prefetching, WebAuthn Related Origin Requests, and WebTransport each cause the browser to open a direct network connection that bypasses both the system‑wide proxy settings and the Private Relay relays. Because these features are part of the default WebKit engine used by Safari and all third‑party browsers on iOS, iPadOS, and macOS, the leak affects a wide range of users. The researchers emphasized that the flaw resides in the way WebKit handles proxy configuration APIs, not in the Private Relay service itself.
DNS Prefetching Leak
DNS prefetching is a performance optimization whereby the browser resolves hostnames in advance of a user’s click. Normally, when a proxy is configured, these DNS queries should be sent through the proxy so that the resolver sees only the proxy’s IP. However, the researchers found that WebKit’s implementation ignores the proxy setting for prefetch requests and instead uses the device’s normal DNS stack. Consequently, the true IP address of the device is revealed to the DNS server, which can be logged or correlated with the subsequent HTTP request, effectively exposing the user’s location despite Private Relay being active.
WebAuthn Related Origin Requests Leak
WebAuthn Related Origin Requests are triggered when a website uses the Web Authentication API to verify the legitimacy of a credential request. As part of this process, the operating system’s credential service fetches a validation file (often named assetlinks.json or apple‑app‑site‑association) from the origin’s domain. The researchers observed that this fetch is performed outside of any configured proxy, using the device’s direct network interface. Therefore, an attacker‑controlled website can cause the device to contact its own server directly, leaking the real IP address. Notably, this occurs even if the user never interacts with a passkey or completes an authentication flow; merely loading a page that includes the WebAuthn trigger is sufficient.
WebTransport Leak
WebTransport is a newer API that enables low‑latency, bidirectional communication over HTTP/3. When a website creates a WebTransport session, WebKit establishes a direct HTTP/3 connection to the specified endpoint. The researchers confirmed that this connection also bypasses the system proxy and Private Relay, sending packets straight from the device’s network stack. Because HTTP/3 encrypts its payload, the traffic appears as regular encrypted UDP packets to observers, but the underlying IP address is still visible to the remote server. This means any site that opts to use WebTransport for real‑time data exchange can obtain the user’s true IP address regardless of Privacy Relay protections.
Impact on Passkeys and User Interaction Requirements
Although the leak is most easily demonstrated via WebAuthn Related Origin Requests, the researchers stressed that the vulnerability does not depend on the user actually employing passkeys. A malicious site only needs to include the appropriate JavaScript or HTML that triggers the WebKit API; the browser will then perform the background request that leaks the IP. Consequently, even users who never enable or use passkeys remain at risk. The lack of required user interaction makes the flaw particularly stealthy, as the exposure occurs silently during normal page loading, leaving no obvious trace in the user’s browsing history or consent prompts.
Scope Across Devices, OSes, and Browsers
The issue is not confined to iOS Safari. Because WebKit is the shared rendering engine for all browsers on Apple platforms—including Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, and others—the same proxy‑bypass behavior appears in those applications when they rely on WebKit’s networking layer. Furthermore, macOS inherits the identical WebKit implementation, so desktop users are equally affected. The researchers noted that browsers that use their own networking stacks (e.g., the desktop version of Chrome) are not vulnerable, highlighting that the problem is specific to WebKit’s handling of proxy settings rather than a system‑wide networking flaw.
Proof‑of‑Concept, Mitigations, and Apple’s Response
To demonstrate the leak, the researchers published a proof‑of‑concept website at leaks.psylo[.]app. Visiting the site shows a side‑by‑side comparison: the “HTTPS Traffic” section displays the normal proxied connection, while the “Possible IP leaks” section reveals the device’s actual IP address when any of the three WebKit features are triggered. They also noted that using a reputable VPN mitigates the issue, as the VPN encrypts and routes all traffic before it reaches the device’s network interface, effectively hiding the real IP even when WebKit bypasses the proxy. Apple has not yet issued a public patch but told 404 Media that it is investigating the researchers’ report; the company previously addressed a similar WebRTC‑based IP leak in Private Relay shortly after its 2021 launch.
Historical Context and Recommendations
This discovery adds to a growing list of privacy‑edge cases where iCloud Private Relay’s assurances have been undercut by underlying platform features. Earlier, FingerprintJS identified a WebRTC‑based mechanism that leaked the real IP address despite the relay being active, and more recently a flaw in Hide My Email allowed real email addresses to be exposed under certain conditions. Users seeking stronger anonymity should consider combining Private Relay with a trusted VPN, disabling or restricting WebKit features that are not needed (for example, via enterprise policies or content blockers), and staying alert for security updates from Apple. Developers, meanwhile, ought to audit their use of WebAuthn, DNS prefetching, and WebTransport to ensure they do not inadvertently expose visitor IP addresses when privacy‑preserving services are in play.