WebKit Can Leak the IP Address Private Relay Is Supposed to Hide

Privacy researchers Talal Haj Bakry and Tommy Mysk found three WebKit features that can bypass browser-level proxy settings and reveal information about a user’s real network.

The issues affect WebKit-based browsers that route traffic through the WKWebsiteDataStore.proxyConfigurations API. The researchers also reproduced all three leaks while using Apple’s iCloud Private Relay.

The three paths are:

• DNS prefetching, which can resolve a website-controlled hostname through the device’s normal DNS connection instead of the configured proxy
• WebAuthn Related Origin Requests, which can cause the operating system’s credential service to contact a server directly and reveal the device’s real IP address
• WebTransport, which can open a direct HTTP/3 connection that bypasses the browser’s configured proxy

The WebAuthn leak is especially concerning because the validation request can occur without the person interacting with a passkey prompt. A website can trigger the supporting request in the background and observe the real IP address that contacts its server.

This undermines the protection people reasonably believe they are receiving.

Apple describes Private Relay as a system that prevents any single party from seeing both who someone is and which websites they visit. Safari requests are supposed to pass through two separate relays, with the destination receiving a temporary IP address instead of the user’s real one.

These three connections occur outside the ordinary page-loading path covered by that protection. A page may therefore appear to load through Private Relay while a separate WebKit feature quietly communicates through the device’s actual network.

The DNS leak does not directly send the complete browsing request outside the relay, but a website can generate a unique hostname for each visitor and watch for the resulting lookup. That can reveal the person’s real DNS resolver and link the proxied browsing session to the network making the lookup.

The WebAuthn and WebTransport issues go further by exposing the device’s real public IP address to a server controlled by the website.

Mysk discovered the problem after a user of its Psylo browser noticed that certain websites were leaking DNS requests. The investigation uncovered the original DNS issue and the two additional IP-address leaks. The researchers also published a proof-of-concept page that tests whether a browser is affected.

Psylo 1.3.1 mitigates all three issues by blocking DNS prefetch hints and disabling WebTransport and WebAuthn by default. People can re-enable the latter features for individual browsing sessions when a website genuinely requires them.

That is a reasonable privacy model: potentially identifying capabilities should be off until the person decides that a particular website needs them.

According to the researchers, system-level VPNs are not affected by these specific bypasses because they tunnel the device’s network traffic below WebKit. That does not make every VPN trustworthy, but it does demonstrate the difference between proxying expected browser traffic and protecting every network connection the browser or operating system might create.

This is another example of why privacy cannot be judged solely by whether a product displays a shield icon or says that an IP address is hidden.

Modern browsers contain numerous subsystems developed for performance, authentication and real-time communication. If even one of them creates a connection outside the expected privacy boundary, a website may be able to recover information the larger system promised to conceal.

Private Relay remains useful against many ordinary forms of network observation and IP-based tracking. These findings do not mean that every Safari request exposes the user’s real address.

They do mean that the protection is not as complete as its users were likely led to believe.

Apple needs to ensure that every WebKit networking feature respects the same proxy and privacy configuration as an ordinary page request. A privacy system cannot protect only the traffic its designers remembered to route through it.

Read “IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay.”