Privacy researchers have disclosed three WebKit networking behaviors that can bypass application-level proxies and Apple's iCloud Private Relay, potentially exposing a user's real IP address or DNS requests.
The issues involve DNS Prefetching, WebAuthn Related Origin Requests, and WebTransport. Because these requests occur outside WebKit's normal proxied networking path, they can connect directly from the device instead of through the configured proxy. System-wide VPNs are not affected since they tunnel all traffic at the operating system level.