Apple WebKit vulnerabilities reveal your IP address, despite Private Relay

Researchers found three WebKit mechanisms—DNS prefetching, WebAuthn/passkey verification fetches, and WebTransport connections—that execute outside Safari’s proxied page-loading path, allowing websites to receive traffic directly from devices and thus bypass iCloud Private Relay and other WebKit-based proxy configurations; this affects Safari on iOS/macOS and other apps that rely on WebKit, and the issue has been reported to Apple with patches expected.