cyber.hendryadrian.com
Security News · securityonline.info

Researchers Report WebKit Network Leaks Despite iCloud Private Relay

· Original article ↗

Summary

Researchers say WebAuthn, DNS prefetching and WebTransport can expose real IP or DNS data despite iCloud Private Relay on iOS browsers. Apple is investigating; the article recommends a system-wide VPN as a temporary mitigation.

Key points

  • Researchers report that WebAuthn passkey authentication can expose users’ real IP addresses and DNS information outside Safari’s Private Relay protections.
  • The article says WebKit delegates WebAuthn operations to system credential services that make direct network requests.
  • DNS prefetching and WebTransport are also reported to expose network identifiers.
  • The reported exposure affects Safari and third-party browsers on iOS because it stems from WebKit behavior.
  • Apple is investigating the report; the article recommends a system-wide VPN as a temporary measure until patches arrive.

Article Details

Event Type
Privacy vulnerability causing IP address and DNS information leaks through WebKit-related network activity despite iCloud Private Relay
Impact
WebAuthn passkey authentication, DNS prefetching, and WebTransport can expose users’ real IP addresses or DNS information to target servers. The article says the issue affects Safari and third-party browsers on iOS. Apple acknowledged the report and is investigating; no official patch is reported. A system-wide VPN is suggested as a temporary mitigation.

Vendors

AppleApple’s iCloud Private Relay protects Safari traffic, but it is not a full device-wide VPN and can fail to hide real IP and DNS data during passkey authentication and other WebKit-related network actions.

Products

iCloud Private RelayApple’s iCloud Private Relay protects Safari traffic, but it is not a full device-wide VPN and can fail to hide real IP and DNS data during passkey authentication and other WebKit-related network actions.iOSSecurity researchers found that WebAuthn, DNS prefetching, and WebTransport can expose user network identifiers, affecting both Safari and third-party browsers on iOS.SafariApple’s iCloud Private Relay protects Safari traffic, but it is not a full device-wide VPN and can fail to hide real IP and DNS data during passkey authentication and other WebKit-related network actions.WebKitApple’s iCloud Private Relay protects Safari traffic, but it is not a full device-wide VPN and can fail to hide real IP and DNS data during passkey authentication and other WebKit-related network actions.

Related Articles