August 4, 2026
Private Relay? More like Private Reveal
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
Apple privacy fans are freaking out after hidden browser leaks exposed real addresses
TLDR: Researchers say some Apple browser features can accidentally expose a user’s real connection even when privacy tools are meant to hide it. Commenters swung between confusion, frustration, and “told you so” skepticism, with some demanding more control and others questioning whether iPhone browser privacy was ever truly independent.
Apple’s privacy crowd just got hit with a very awkward plot twist. Researchers at Mysk say some WebKit features in Apple-style browsers can quietly reveal a user’s real internet address or DNS trail even when a privacy tool is supposed to hide it. In plain English: people thought traffic was taking the secret tunnel, but a few side doors were allegedly left open. The team says this can affect proxy-based browsers on iPhone and Mac, and even iCloud Private Relay, Apple’s big privacy perk. Psylo says it already patched things on its side.
But the real fireworks are in the comments, where the mood is a mix of panic, annoyance, and eye-rolling skepticism. One user basically said, “I love Private Relay, now please give me an off switch,” which is the most 2026 tech-user mood imaginable: trust issues, but make it customizable. Another commenter ran the leak test and got a confusing mess of results, shrugging that they’d happily disable WebAuthn because they barely use it anyway. And then came the spiciest jab: if every iPhone browser is still built on Apple’s engine, can any third-party “privacy browser” really save the day? That sparked the classic Apple debate — is this a fixable bug, or proof that the whole “choice” thing on iOS is just fancy branding? The jokes weren’t subtle either: privacy, apparently, is now private-ish.
Key Points
- •The article reports that three WebKit features can bypass app-level proxy configurations in WebKit-based browsers on iOS and macOS.
- •The three features identified are DNS prefetching, WebAuthn Related Origin Requests, and WebTransport, which can reveal real DNS infrastructure or the device’s real IP address.
- •The authors state that the same leaks also affect Apple’s iCloud Private Relay.
- •The article says VPNs are not affected because they route traffic at the system level rather than through an app-level proxy.
- •Psylo 1.3.1 mitigates the issue by blocking `dns-prefetch` and disabling WebTransport and WebAuthn by default, with per-silo opt-in controls.