Post #4384675

Security Bulletin: WebKit's handling of passkeys can cause iCloud Private Relay to leak your device's real IP address. The same behaviour affects all iOS browsers that rely on proxy connections to hide the device's IP, including Psylo, Onion Browser, and other proxy or Tor browsers on iOS. The IP address is exposed as soon as you open a website that supports passkeys, even if you never try to sign in with one. For example, simply opening facebook[.]com in Safari is enough to expose your real IP address to Facebook. We also found two more WebKit issues: • DNS prefetching bypasses the proxy tunnel and leaks DNS queries. • WebTransport ignores the established proxy connection and exposes the device's real IP address. These behaviours affect Safari and all proxy browsers on iOS, since Apple requires all iOS browsers to use WebKit. Note that VPNs are not affected by these issues, since they tunnel the device's entire network traffic at the system level. We've updated Psylo to disable passkeys and WebTransport by default in all silos, and you can re-enable them per silo. We also disabled DNS prefetching entirely. Please update to version 1.3.1. We built a website that detects these leaks. The video below shows them in action. Link to the blog post: https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/ Use this website to check if your browser leaks your IP and DNS: https://leaks.psylo.app/ #privacy #Apple #iOS #macOS #infosec