研究人员在WebKit中发现了三个安全漏洞，允许网络流量绕过代理配置直接从设备发送[1]。这些漏洞涉及DNS预解析、WebAuthn相关源请求和WebTransport连接等功能[1]，影响iOS和macOS平台上所有基于WebKit的代理浏览器以及苹果的iCloud Private Relay服务[1]。
具体而言，iOS 26.0开始支持的DNS预解析功能会通过设备的DNS路径而非代理的DNS路径进行解析[1]；WebAuthn Related Origin Requests功能从iOS 18.0起提供[1]；WebTransport则从iOS 26.4（2026年3月）开始公开发布[1]。由于App Store政策要求所有iOS浏览器必须使用WebKit引擎[1]，因此所有基于WebKit的代理浏览器均受到影响。
代理浏览器Psylo已在1.3.1版本中实现了修复措施，包括阻止DNS预解析提示、默认禁用WebTransport和WebAuthn功能[1]。用户可通过https://leaks.psylo.app的概念验证网站测试这些漏洞[1]。
Security researchers have identified three vulnerabilities in WebKit that enable network traffic to bypass proxy configurations and leak directly from devices running iOS and macOS. [1] These vulnerabilities stem from DNS prefetching, WebAuthn-related origin requests, and WebTransport connections, all of which route through the device's own DNS path rather than the proxy's DNS path. [1] The flaws affect all WebKit-based proxy browsers and Apple's iCloud Private Relay service. [1]
The vulnerability landscape spans multiple iOS versions. DNS prefetching has been supported since iOS 26.0, while WebAuthn-related origin requests became available starting with iOS 18.0. [1] WebTransport will see public release beginning with iOS 26.4 in March 2026. [1] Because App Store policy mandates that all iOS browsers use WebKit, every proxy browser on the platform is vulnerable to these leaks. [1] Users can verify their exposure using a proof-of-concept website at https://leaks.psylo.app. [1]
Psylo browser has addressed these risks in version 1.3.1 by implementing three countermeasures: blocking DNS prefetch hints, disabling WebTransport by default, and disabling WebAuthn by default. [1]