Apple WebKit Vulnerabilities Expose Real IP Addresses Bypassing iCloud Private Relay and Proxies
Executive Summary
Recent research has disclosed a significant security flaw within Apple's WebKit protocol handling that undermines critical privacy protections. According to a Malwarebytes Labs Analysis, these vulnerabilities allow for the bypass of iCloud Private Relay, Psylo proxies, and various browser-level proxy configurations. This failure in protocol isolation results in the exposure of a user's actual public IP address and the specific ISP DNS resolver path, effectively de-anonymizing users who believe their traffic is being routed through a secure relay or proxy.
Deep-Dive Technical Analysis
The disclosure highlights three primary vectors through which WebKit fails to maintain the integrity of proxy and relay boundaries.
1. WebRTC ICE Candidate Gathering
The WebRTC (Web Real-Time Communication) framework within WebKit utilizes Interactive Connectivity Establishment (ICE) to facilitate peer-to-peer connections. The research reveals that ICE STUN/TURN requests are capable of bypassing browser proxy settings entirely. By initializing direct socket connections to external servers, the process leaks both local and public IPv4 and IPv6 addresses, providing a direct map to the user's actual network location.
2. Web Push Background Fetchers
WebKit's implementation of background push notification fetchers and ServiceWorker push subscriptions contains a critical routing error. These components initialize direct TCP and UDP streams that operate outside of Safari's standard proxy pipeline. This architectural gap allows push-related traffic to circumvent the iCloud Private Relay dual-hop architecture, reaching out to remote servers from the user's unmasked IP address.
3. Custom Scheme/Protocol Handlers
Registered URL scheme handlers—such as facetime://, itmss://, or other custom application schemes—can be exploited to reveal user identity. When these schemes are invoked, they trigger system-level handler processes. These processes initiate direct socket requests to remote web servers, disclosing the unmasked IP address and the ISP DNS path, thereby bypassing any browser-level privacy layers established by the user.
Privacy & Enterprise Security Implications
The implications of these WebKit vulnerabilities are severe for specific high-risk cohorts. Remote corporate employees relying on browser-level proxies to access internal resources may inadvertently expose their home or remote network locations. More critically, journalists, dissidents, and individuals with high-risk privacy personas who depend on iCloud Private Relay or browser-level relays for safety are at risk of being tracked or identified by the very entities they are attempting to avoid. The bypass effectively renders browser-centric privacy protections unreliable for those who need them most.
Industry Impact & Actionable Mitigations
To defend against these exposures, security professionals and users should adopt a multi-layered mitigation strategy as detailed in the Malwarebytes Labs Analysis.
Mitigation Category
Actionable Steps
WebKit & Safari Configuration
Manually disable WebRTC STUN/TURN handling within WebKit experimental settings and Safari advanced privacy preferences to prevent ICE candidate leaks.
OS-Level Tunneling
Shift from browser-level proxy extensions to system-wide network tunnels. Enforce WireGuard or IPsec VPN tunnels at the operating system network stack level to ensure all traffic, including background processes, is encapsulated.
DNS Leak Prevention
Configure encrypted DNS protocols, such as DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), at the OS level. This prevents the system from defaulting to ISP DNS resolvers that can be used to track user activity.