Mysk finds three WebKit features that bypass proxy configuration and leak the device IP and DNS

Sources: research, discussion
Summary: Talal Haj Bakry and Tommy Mysk report three WebKit features that ignore the proxy set through WKWebsiteDataStore.proxyConfigurations and connect directly from the device. DNS prefetching resolves hostnames through the device's normal DNS path, available on iOS since 26.0. WebAuthn Related Origin Requests make the operating system's credential service fetch the relying party's .well-known/webauthn document itself, available since iOS 18.0, and the post states the fetch fires with conditional mediation and no user interaction. WebTransport opens a QUIC connection with WebKit's own network parameters, shipped in iOS 26.4. The authors state all three also defeat iCloud Private Relay because they run outside WebKit's standard page-loading path, that VPNs are unaffected because they tunnel at the system level, and that Onion Browser's Silver level avoids the WebTransport leak by running WebKit in Lockdown Mode. The authors sell Psylo, the browser whose 1.3.1 release carries their mitigations, so the write-up is both research and product marketing.
Why it matters: App Store policy requires every iOS browser to use WebKit, so every iOS Tor browser inherits the same three paths regardless of how it configures its proxy.