WebKit IP and DNS Leaks Affect Proxy Browsers and iCloud Private Relay

A set of vulnerabilities in WebKit, the browser engine powering Safari and many other browsers, leaks users' real IP addresses and DNS queries even when privacy features are active. The leaks affect proxy browsers, VPN extensions, and Apple's iCloud Private Relay.

For users who rely on these tools for privacy, the findings are concerning. The very features designed to protect identity are undermined by the underlying browser engine.

What Was Discovered

Security researchers found that WebKit handles certain web APIs in ways that bypass proxy configurations and VPN tunnels. The leaks occur through several mechanisms:

WebRTC leaks: WebRTC, used for voice and video chat, can reveal a user's real IP address even when a proxy or VPN is active. WebKit's implementation does not properly route WebRTC traffic through privacy protections.

DNS leaks: DNS queries, which translate domain names to IP addresses, sometimes go directly to the system DNS resolver instead of through the privacy-protecting tunnel. An observer watching DNS traffic sees which sites a user visits.

WebSocket leaks: WebSocket connections can establish direct connections that bypass proxy settings, revealing the real IP address to the destination server.

Service worker leaks: Service workers, which enable offline functionality, sometimes make network requests outside the privacy-protected channel.

Who Is Affected

The vulnerabilities affect any browser built on WebKit. That includes:

Safari: Apple's default browser on macOS and iOS. Users who rely on iCloud Private Relay for privacy are directly affected.

Proxy browsers: Several privacy-focused browsers built on WebKit promise anonymous browsing through proxy connections. The leaks undermine that promise.

iOS browsers: All browsers on iOS must use WebKit due to Apple's requirements. Chrome, Firefox, and Edge on iOS are all affected.

macOS applications: Apps that embed WebKit views for rendering content can be affected if they handle sensitive URLs.

Apple's Response

Apple acknowledged the issues and released patches for some of the leak vectors. iCloud Private Relay received updates to better handle WebRTC traffic. Safari got fixes for specific DNS leak scenarios.

However, not all vectors are fully patched. Some leaks require architectural changes that are harder to deploy quickly. Apple's security advisories note that certain protections remain incomplete.

What Users Can Do Right Now

While waiting for complete patches, several steps reduce exposure:

Disable WebRTC: Most browsers allow WebRTC to be disabled or configured to use only the proxy connection. This closes the most reliable leak vector.

Use DNS over HTTPS: Encrypting DNS queries prevents local observers from seeing which sites are visited, even if the query leaks outside the tunnel.

Test for leaks: Several websites test whether a browser leaks IP or DNS information. Run these tests to understand the current exposure level.

Consider alternative engines: On platforms that allow it, browsers based on other engines may not be affected by these specific WebKit issues.

Keep software updated: Apply browser updates promptly as patches become available.

The Broader Privacy Implications

These leaks highlight a fundamental challenge in browser privacy. Privacy features like proxy routing and private relay work at the network layer. But web APIs operate at the application layer. When application-layer features do not respect network-layer privacy protections, leaks occur.

Building truly private browsers requires coordination across all layers of the browser stack. A privacy feature is only as strong as its weakest link. WebKit's leaks show that even well-intentioned privacy measures can be undermined by implementation details.

The Road Ahead

Browser engines are complex. Each new feature adds potential leak vectors. The arms race between privacy protections and leak techniques continues.

Users who depend on privacy features should stay informed about vulnerabilities and apply mitigations promptly. Relying on any single privacy feature without verification is risky. Layering protections and testing for leaks remains the best strategy.

The WebKit leaks are a reminder that privacy requires vigilance. Tools help, but they are not perfect. Understanding their limitations is the first step toward real protection.