Posts for: #Psylo

We recently disclosed three WebKit issues that can leak a user’s DNS traffic or reveal their real IP address, even when the browser is configured to route traffic through a proxy. The issues affected our own browser, Psylo, Apple’s iCloud Private Relay, and other proxy-based browsers on iOS, including Tor browsers such as Onion Browser. Our decision to disclose the issues publicly before informing Apple sparked some debate about responsible disclosure, so we want to explain the reasoning behind our decision and share our broader thoughts on responsible disclosure.

WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay. All three are fixed in Psylo 1.3.1.

[Updated: 2025-09-04] This is the first in a series of posts covering technical aspects of Psylo. Here, we’ll explore the overall system architecture, including subscriptions, authorization, integration with the Mysk Private Proxy Network, and highlight trade-offs and future improvements identified in this initial 1.0 release.

We’re super excited to finally launch Psylo, a new kind of private web browser for iOS and iPadOS. In Psylo, each tab is its own silo with isolated storage, cookies, and even its own IP address. Psylo introduces advanced anti-tracking and anti-fingerprinting features that go beyond what a VPN can offer, thanks to the deep integration between Psylo and our own Mysk Private Proxy Network. Psylo is backed by years of insights from our privacy research at Mysk. Psylo is available today on the App Store as a monthly or annual subscription with a free 7-day trial.