IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay
Summary
New research shows three WebKit features—DNS prefetching, WebAuthn related origin requests, and WebTransport—bypass proxy configurations in WebKit-based browsers on iOS/macOS, leaking the user's real IP and affecting iCloud Private Relay. The authors verify leaks with a PoC site and disclose mitigations in Psylo 1.3.1, which blocks dns-prefetch, and disables WebTransport and WebAuthn by default, with per-site opt-ins possible.