WebKit Privacy Leaks Undermine Proxy and VPN Products
A disclosed vulnerability in WebKit is leaking real IP and DNS information in proxy browsers and through iCloud Private Relay. The thread is notable because it surfaces a structural problem: Apple forces all iOS browsers to use WebKit, so a WebKit bug is a bug in every iOS browser simultaneously, including ones that specifically market themselves on privacy.
The iCloud Private Relay angle is particularly sharp. Apple has marketed Private Relay as a privacy feature that hides your IP from websites and network operators. A WebKit-level leak that bypasses it means the privacy guarantee is not what users believe it to be, and the fix is entirely in Apple's hands, not the browser vendor's.
Commenters are asking for CLI tools to toggle Private Relay programmatically, which suggests power users have already internalized that the system-level privacy controls are not reliable enough to trust without verification.
So what?
If you are building a privacy product on iOS, your threat model needs to include platform-level bugs that are outside your control and may not be disclosed promptly. Founders in the VPN and privacy browser space should be running leak tests against WebKit regularly and being honest with users about what guarantees you can and cannot make at the application layer.