Web Kit-based browsers on iOS and macOS can be set to route all traffic through a proxy, which Tor browsers on iOS and Psylo work. However, three Web Kit features — DNS prefetching, Web Authn Related Origin Requests, and Web Transport — bypass the proxy and send traffic directly from the device, exposing the user’s network.

The DNS prefetch leak, first reported by a Psylo user, occurs when a page includes a <link rel="dns-prefetch"> tag; the lookup resolves via the device’s normal DNS path, revealing real DNS servers even with iCloud Private Relay enabled. Web Authn related requests let the OS credential service fetch a validation file directly, exposing the device’s IP. Web Transport opens a direct HTTP/3 connection that also leaks the IP.

These leaks also affect Apple’s iCloud Private Relay, but VPNs are unaffected because they tunnel the entire network at the system level. The Tor Project and the iOS Onion Browser developers have been notified, and a proof‑of‑concept site at leaks.psylo.app can be used to test the issues. Psylo 1.3.1 fixes them by blocking DNS prefetch hints and disabling Web Transport and Web Authn by default, with optional per‑silo toggles.

Desktop Safari has supported <link rel="dns-prefetch"> since Safari 5, but iOS ignored it until iOS 26.0 (September 2025), when Web Kit enabled it, removing older speculative prefetching. The combined fixes keep privacy in the user’s hands while preserving needed functionality.