Apple requires all browsers on iPhone to use Apple’s WebKit, and a recent report shows that every browser can suffer three separate data leaks even when using a proxy or iCloud Private Relay. The leaks stem from DNS prefetching, WebAuthn for Passkeys, and WebTransport, which can all reveal user information beyond the encrypted tunnel.

The Mysk blog details each flaw: DNS prefetching on iOS 26 resolves hostnames through the normal DNS path instead of the proxy RESULTS in a leak; WebAuthn, introduced in iOS 18, fetches रिलेशनल files from the device that expose the IP address; and WebTransport, active since iOS 26.4, opens a direct HTTP/3 connection that exposes the real IP.

Affected browsers include Safari, Tor, and proxy apps, while VPNs remain safe because they encrypt all traffic at the system level. The developer of the Psylo app has patched the three vulnerabilities in the latest update by disabling the features, though users must manage them per site.

Apple will likely need to address the issues in a future OS release, but users can mitigate risk by using a VPN. The leaks are now public, potentially accelerating a fix from Appleட்டு.