DNS and IP leaks on iOS: WebKit bypasses your proxies even with iCloud Private Relay active

Researchers at mysk.blog discovered that WebKit—the mandatory engine for all iOS browsers—sends DNS requests and reveals the real IP address before the proxy tunnel is established. iCloud Private Relay does not protect against this behavior.

The Technical Issue

Researchers at mysk.blog have documented a leak in WebKit (the rendering engine Apple mandates for all browsers on iOS/iPadOS via App Store rules): in certain network configurations, WebKit issues DNS requests or establishes TCP connections before the configured proxy is active, thereby exposing:

• The device's actual IP address to third-party servers
• The domain names of loaded resources (DNS leak)

This behavior bypasses iCloud Private Relay (Apple’s network privacy feature for iCloud+ subscribers) as well as manually configured VPNs and proxies.

Scope

Who is affected:

• Any iOS/iPadOS user relying on a VPN or proxy for privacy
• iCloud+ subscribers who depend on Private Relay to hide their IP
• Apps using WKWebView (WebKit’s standard webview component in iOS apps)

What may be exposed:

• The device’s real IP address, revealed to intermediate DNS servers
• Domain names of loaded resources, exposed outside the tunnel

The leak is partial and conditional—it does not apply to all requests but to specific resource-loading behaviors. Still, it is sufficient to compromise network privacy in sensitive contexts.

iOS Context: One Engine to Rule Them All

On Android, Chrome uses Blink, Firefox uses Gecko. On iOS, every browser—Chrome, Firefox, Brave, Opera, DuckDuckGo—is forced to use WebKit by App Store rules. A flaw in WebKit therefore affects 100% of iOS browsers simultaneously, regardless of the vendor.

Apple introduced a partial exception for alternative browsers in the European Union (DMA, 2024), but most iOS users worldwide remain on WebKit.

What to Do

Users:

• Do not treat iCloud Private Relay as absolute anonymity protection—it reduces traceability but is not a full VPN
• Apply the next iOS/iPadOS update as soon as it is available (the fix will come via a WebKit patch)
• For high-privacy use on iOS, combine a VPN with active network traffic monitoring

Developers:

• Test your WKWebView setups with an active proxy and a network capture tool (Charles Proxy, mitmproxy) to detect any out-of-tunnel requests
• Ensure your WebView components do not perform prefetch/preconnect requests before network configurations are properly established