WebKit leaks in iOS & macOS expose user data despite proxy use
Three separate vulnerabilities in WebKit browsers can bypass proxy and iCloud Private Relay protections.
1Scope of WebKit vulnerabilities
Apple mandates all browsers on iPhone to use WebKit engine, making every browser vulnerable to three distinct leaks on iOS and macOS. According to Mysk blog, these leaks can expose user data despite proxy or iCloud Private Relay usage. Affected software includes Tor browsers, proxy apps, and Safari. The vulnerabilities bypass privacy protections users expect when employing these tools.
2DNS prefetching issue
WebKit's DNS prefetching feature resolves IP addresses of likely future visits to improve performance. However, it makes direct DNS queries outside proxy tunnels. This allows tracking of users' intended web destinations even when using proxies or iCloud Private Relay. The prefetching occurs without user consent, creating privacy concerns for security-conscious individuals.
3WebAuthn and Passkeys risk
The WebAuthn standard enables passwordless biometric logins, but WebKit's implementation leaks device identifiers during authentication. Apple's Passkeys integration exacerbates this issue by potentially exposing user identities despite proxy protections. Security researchers note this could deanonymize users who rely on these convenient authentication methods.
4WebTransport protocol flaw
WebTransport facilitates low-latency communication between browsers and servers, but WebKit's handling bypasses proxy rules in UDP-based communications. This leaks users' real IP addresses and location data. The protocol's relatively new adoption means many users are unaware of this privacy trade-off in their browsing experience.
5Why VPNs remain secure
The report confirms VPN users are unaffected because VPNs encrypt all network traffic at system level, unlike proxies and iCloud Private Relay which only route specific protocols. This fundamental architectural difference makes VPNs more reliable against WebKit-based leaks. Security experts recommend VPNs for users requiring absolute privacy protection.
6Apple's browser policy impact
Apple's App Store policies require all iOS browsers to use WebKit, preventing alternative engine development. This monopoly means WebKit vulnerabilities affect all browsers equally, severely limiting user choice for privacy protection. Critics argue this policy harms browser innovation and user security in the iOS ecosystem.
7User risk assessment
These leaks pose significant risks for privacy-sensitive users like journalists, activists, and professionals handling sensitive data. Exposed information includes visited sites, geographic locations, and device identifiers. Even with proxy use, targeted individuals could be identified through these WebKit vulnerabilities.
8Awaiting solutions
Security professionals urge Apple to promptly patch these vulnerabilities. The persistence of such fundamental security issues in WebKit, despite being open-source, raises concerns about Apple's privacy commitments. As temporary measures, users might consider switching to VPNs or non-WebKit devices until fixes are implemented.