Apple patched an iCloud Private Relay IP leak in Safari with iOS 26.6.1 and macOS 26.6.2, but the fix does not extend to third‑party WebKit browsers that rely on Apple’s proxy configuration APIs.

The update isn’t listed in Apple’s public security release notes, and Mysk notes the mitigation seems limited to Safari while other browsers using the same proxy APIs may remain vulnerable.

Clarkson Law Firm has filed legal action tied to Apple’s advertising of AI features and other products, signaling potential broader scrutiny.

Researchers from Mysk and Psylo identified three WebKit features that could bypass the app‑level proxy—dns-prefetch, WebAuthn Related Origin Requests, and WebTransport—potentially exposing the real IP or DNS infrastructure.

Users on iOS 26.6.1 or macOS 26.6.2 should update to the latest versions and test for leaks at leaks.psylo.app; third‑party proxy browsers should also update and consider a system‑level VPN for stronger protection.

Leaks involved WKWebsiteDataStore.proxyConfigurations, introduced in iOS 17 and macOS 14, which allows routing WebKit traffic through remote proxies; some WebKit requests could bypass this path.

A public test page (leaks.psylo.app) lets users verify vulnerability; after the fix, it reports the masked IP when iCloud Private Relay is active.

Apple patched a vulnerability in iCloud Private Relay that could leak a user’s IP address even when the feature is enabled.

Psylo mitigated similar leaks in version 1.3.1 by blocking DNS‑prefetch and disabling WebAuthn and WebTransport by default; system‑level VPNs are unaffected since they operate outside WebKit’s proxy controls.

Apple did not immediately respond to requests for comment.

The vulnerability affected Safari and apps using the WebKit framework, and was first discovered by Talal Haj Bakry and Tommy Mysk.

iCloud Private Relay is a paid feature for iCloud Plus subscribers, designed to mask IP by routing traffic via proxy servers, not a VPN.