Apple has quietly fixed an iCloud Private Relay IP address leak in the public releases of iOS 26.6.1 and macOS 26.6.2.
The fix appears limited to Safari, while other WebKit-based browsers using Apple's proxy configuration APIs remain affected. Apple has not mentioned the change in its security release notes.
Mysk co-founder Tommy Mysk told CyberInsider that the issue was still present in an iOS 26.6.1 beta the researchers tested but could no longer be reproduced after installing the final public release.
Mysk and Psylo developer Bakry originally disclosed the issue on August 5, 2026, after investigating DNS leaks reported by a Psylo user. Their testing uncovered three WebKit features that can bypass application-level proxy settings and potentially expose a user's real IP address or DNS infrastructure.
Apple's iCloud Private Relay is designed to conceal Safari users' IP addresses by routing traffic through separate relays. However, the researchers found that some WebKit-generated requests could bypass that protected route entirely.
Three WebKit features could bypass proxy connections
The first issue involved dns-prefetch, an HTML feature that resolves domains before they are needed. WebKit could send these lookups through the device's regular DNS connection instead of the configured proxy, potentially exposing the user's network or DNS provider.
A second leak affected WebAuthn Related Origin Requests. During some passkey operations, Apple's credential service may fetch a validation file outside the browser's proxied path, exposing the device's real IP address to the remote server.
The third involved WebTransport, a low-latency protocol based on HTTP/3 and QUIC. Researchers found that WebTransport connections could bypass the application's proxy configuration and connect directly.
The affected proxy mechanism uses WKWebsiteDataStore.proxyConfigurations, introduced in iOS 17 and macOS 14 to let browsers route WebKit traffic through remote servers.
Because Apple requires all iOS App Store browsers to use WebKit, the issue can affect third-party browsers even when they provide their own proxy or privacy features.
Psylo mitigated the leaks in version 1.3.1 by blocking DNS-prefetch and disabling WebAuthn and WebTransport by default. System-level VPNs are not affected because they route traffic at the operating-system level rather than through WebKit's application-level proxy controls.
Apple fixes Safari, but third-party browsers remain affected
According to Mysk, Apple addressed the leaks in Safari with the final iOS 26.6.1 and macOS 26.6.2 releases, even though the fix was absent from the iOS 26.6.1 beta the researchers previously tested.
The change is not listed in Apple's security release notes, and Mysk says the mitigation does not extend to other browsers that rely on the same proxy configuration APIs.
Users running iOS 26.6.1 can test their browser at leaks.psylo.app to check whether requests are escaping the expected proxy path.
Those relying on iCloud Private Relay should update to iOS 26.6.1 or macOS 26.6.2. Users of third-party proxy-based browsers should also install available browser updates and consider a system-level VPN when preventing direct network connections is essential.
Leave a Reply