WebKit privacy and IP leak vulnerabilities

WebKit flaws leak IP and DNS data in proxy browsers and iCloud Private Relay

WebTransport API shipped publicly in iOS 26.4.

First traces of the WebTransport API appeared in 2023, but the feature remained disabled until December 2025. At that time, it was switched on for platforms possessing sufficient Network.framework support, eventually shipping publicly in iOS 26.4 in March 2026.

WebTransport functions as a low-latency alternative to WebSocket that runs over HTTP/3 and QUIC, providing multiple independent streams and unreliable datagram delivery, with the ability to fall back to HTTP/2 when QUIC is unavailable.

WebTransport API was switched on for platforms with sufficient Network.framework support.

While first traces of the WebTransport API appeared in 2023, the feature remained disabled until approximately December 2025. At that time, it was switched on for platforms possessing sufficient Network.framework support.

The API operates as a low-latency alternative to WebSocket, utilizing HTTP/3 and QUIC to offer multiple independent streams and unreliable datagram delivery. It eventually shipped publicly in iOS 26.4 in March 2026.

WebKit enabled dns-prefetch on iOS in version 26.0.

In September 2025, WebKit enabled dns-prefetch on iOS via version 26.0. This update occurred alongside a change that removed the older implicit speculative DNS prefetching used on the platform.

When a page utilizes the dns-prefetch tag, WebKit resolves the hostname through the device's normal DNS path. This process occurs regardless of any proxy settings established through WKWebsiteDataStore.proxyConfigurations, which can potentially reveal the visitor's real network. Furthermore, this leak is not prevented by iCloud Private Relay, as the DNS query reaches the authoritative server from the device's actual network.

Apple announced WebAuthn Related Origin Requests feature for iOS 18.0/Safari 18.0.

In September 2024, Apple announced the WebAuthn Related Origin Requests feature as part of the iOS 18.0 and Safari 18.0 updates. This update included support for the system component responsible for performing the specific validation fetch required by the feature.

Under this standard, a passkey is typically bound to a single domain. However, Related Origin Requests enable an organization to utilize one passkey across a limited set of domains it owns. During these requests, the validation fetch is issued directly from the device's credential service, which operates independently of proxies.