WebKit flaws bypass iCloud Private Relay, revealing real IPs and DNS data
Researchers have documented three WebKit mechanisms—DNS prefetching, WebAuthn verification requests, and WebTransport—that can slip outside iCloud Private Relay, potentially exposing a user’s real IP address or DNS information even when Private Relay is enabled. These are legitimate browser features, and the leaks may affect Safari privacy users and WebKit-based proxy browsers on iOS/macOS. VPNs at the system level remain unaffected, but passkeys aren’t stolen; exposure comes from specific network requests used during verification. To mitigate, keep Private Relay on, install OS updates, consider a full-device VPN when IP privacy is paramount, and monitor browser privacy updates as developers may block these paths (as some browsers have started to do).