WebKit Vulnerabilities Expose Real IP Addresses on iOS and macOS

In digital privacy and system security, the boundary between application-level isolation and operating system networking is a critical defense line. On August 4, 2026, security researchers Talal Haj Bakry and Tommy Mysk disclosed severe WebKit vulnerabilities that expose users’ real IP addresses and DNS queries across iOS, iPadOS, and macOS. These flaws bypass application-configured proxy settings, directly impacting privacy-focused iOS browsers, proxy tools like Psylo and Onion Browser, and Apple’s flagship iCloud Private Relay feature. For journalists, activists, and privacy-conscious users who rely on proxy-based routing to conceal their network footprint, this discovery highlights a dangerous architectural breakdown in Apple’s web ecosystem.

The core issue stems from WebKit—the mandatory browser engine that Apple forces all iOS web browsers to use under its App Store policy. According to the researchers, three modern web standards implemented within WebKit completely bypass application proxy configurations, initiating direct egress connections straight from the device’s local network interface. Consequently, a malicious website can silently harvest a user’s real public residential or mobile IP address and DNS resolver details in the background, completely neutralizing application-level anonymity protections.

The Architectural Gap: How WebKit Bypasses Proxy Rules

To understand how these WebKit vulnerabilities manifest, one must examine how proxy configuration works on Apple platforms. When a privacy-focused browser routes web traffic through an encrypted proxy or Tor circuit, it relies on WebKit’s native configuration interface, specifically the WKWebsiteDataStore.proxyConfigurations API introduced in iOS 17 and macOS 14. Under normal conditions, this API instructs WebKit to send all HTTP fetches, WebSocket connections, and asset requests through designated proxy servers.

However, modern web engines do not process every network interaction through a single, unified pipeline. WebKit delegates specific features to system-level operating system daemons or opens direct socket connections outside the browser sandboxed rendering process. Because these specific network calls operate outside the browser’s proxied loading path, they fail to inherit the rules set in WKWebsiteDataStore.proxyConfigurations. This design flaw creates unmonitored network side channels that reveal the client device’s true IP address to remote servers.

Deconstructing the WebKit Vulnerabilities: Three Direct Bypasses

The research by Haj Bakry and Mysk details three distinct technical vectors within WebKit where proxy boundaries fail. Each vector exploits a different web mechanism, but all three achieve the same result: total unmasking of the user’s real connection details.

1. DNS Prefetching (dns-prefetch)

DNS prefetching is a performance enhancement that pre-resolves domain names embedded in HTML code