Apple iCloud feature leaks user IP addresses

Apple’s iCloud Private Relay feature, a privacy-protecting service for Safari, has been found to be leaking users’ real IP addresses. The issue was discovered by security researchers Talal Haj Bakry and Tommy Mysk, who found that three WebKit features can bypass application-level proxy settings.

These features include DNS prefetching, WebAuthn Related Origin Requests, and WebTransport, which underpin Safari and most other browsers available on iOS. Private Relay is not the same as a traditional VPN, as it does not tunnel every connection at the operating-system level.

The most concerning leak involves WebAuthn, the standard behind passkeys. A webpage can trigger a request that Apple’s credential service fetches directly from the device, rather than through Safari, revealing the user’s real IP address.

This can happen in the background without a passkey prompt or any other sign to the user, and has been present since iOS 18. The other flaws, including DNS prefetching and WebTransport, are newer and can expose the user’s real DNS servers and device IP address.

A proof-of-concept site created by the researchers confirmed that the flaws can reveal an IP address that Private Relay should have concealed. The WebKit flaws also affect proxy-based privacy browsers, including Psylo and Onion Browser.

The incident is an embarrassment for Apple’s paid privacy tools, following a recent report that a flaw in Hide My Email could expose the real addresses behind supposedly anonymous aliases. Apple fixed that bug shortly after it became public, despite having been notified more than a year earlier.

In response to the current issue, Apple has updated the report’s status to indicate that it plans to address the problem, with a fix scheduled for fall 2026. They have also told 404 Media that they are investigating the matter.

Meanwhile, the Tor Project and Onion Browser’s developers have been contacted by the researchers, and Psylo has already taken steps to block DNS-prefetch hints and disable WebTransport and WebAuthn by default.

The discovery of these flaws highlights the ongoing challenges in protecting user privacy online. As internet privacy concerns continue to grow, companies like Apple must balance the need for user convenience with the need for robust security measures.

In the case of Private Relay, the service’s limitations, such as not tunneling every connection at the operating-system level, may have contributed to the vulnerabilities. As the issue is addressed, it will be important for Apple to consider the broader implications of its privacy-protecting services and ensure that they are robust and effective.