Apple's iCloud Private Relay Flaw Exposes User IP Addresses

Apple's iCloud Private Relay, a cornerstone of its paid iCloud+ privacy offering, has been discovered to harbor a critical flaw that can expose users' real IP addresses, directly undermining its core promise of anonymity. On August 5, 2026, security researchers Tommy Mysk and Talal Haj Bakry revealed that a series of issues within Apple's WebKit engine, which powers all browsers on iOS, can bypass Private Relay's protections, allowing websites to discern a user's true location and network identity.

This vulnerability is particularly insidious because it exploits fundamental interactions within Apple's operating system and browser engine. The primary culprit is how passkey-related requests, based on the WebAuthn standard, are handled. When a website supports passkeys, or even merely indicates support, the device's operating system often initiates a network request via its credential service, entirely bypassing Safari's standard browsing stack and, critically, Private Relay's secure tunnels. This means a user's real IP address is directly transmitted to the destination server, even if they believe their privacy feature is active. Compounding the issue, this IP leak can occur simply by opening a webpage that supports passkeys, requiring no explicit action or sign-in from the user. Beyond passkeys, the researchers identified two other WebKit behaviors contributing to the leak: DNS prefetching, which on recent iOS versions can sometimes bypass the Private Relay proxy, and WebTransport, a newer connection method that can similarly ignore the proxy and expose the real IP.

The immediate impact on users is a severe erosion of trust. Private Relay is advertised as a feature that prevents single entities, including Apple and network providers, from correlating a user's IP address with their browsing activity. For iCloud+ subscribers paying for enhanced privacy, this bug reveals that their real IP address, a primary identifier for online tracking and profiling, may be exposed during routine web interactions. This compromises the very purpose of Private Relay, which is designed to encrypt web traffic and route it through two distinct internet relays—one operated by Apple and a second by a third-party like Cloudflare, Akamai, or Fastly—to ensure no single party can link a user's identity to their browsing destinations. The fact that this vulnerability affects not only Safari but *all* browsers on iOS, due to Apple's mandate that they all utilize the WebKit engine, broadens its reach significantly. Even privacy-focused browsers like OnionBrowser, designed to leverage the Tor anonymity network, are reportedly impacted.

This incident marks the second recent privacy misstep for Apple's paid privacy services. Just last month, a bug in the "Hide My Email" feature was reported to reveal users' actual email addresses, a flaw Apple reportedly knew about for over a year before issuing a fix. Such repeated issues cast a shadow over Apple's vaunted "privacy-first" marketing strategy and raise legitimate questions about the thoroughness of its internal security audits and bug remediation processes. While Apple has acknowledged the current Private Relay report and stated it is investigating, no timeline for a fix has been provided. The "dire" nature of the bug, as described by the researchers, underscores the urgency for a swift resolution.

Compared to comprehensive Virtual Private Networks (VPNs), Private Relay has always had inherent limitations; it primarily focuses on Safari web browsing and unencrypted app traffic, explicitly not covering all device traffic. The researchers noted that system-wide VPNs, which route all network traffic at the operating system level, are not affected by this particular WebKit flaw. This distinction becomes crucial now, suggesting that users seeking robust, device-wide IP masking might need to rely on traditional VPN services rather than Apple's integrated solution.

Looking ahead, Apple faces a significant challenge in restoring user confidence. A prompt and transparent patch for the WebKit vulnerabilities is paramount. Beyond a technical fix, the company may need to reassess its approach to integrating new web standards like WebAuthn while ensuring existing privacy safeguards remain uncompromised. This bug also ignites further debate around Apple's strict WebKit mandate on iOS, as a flaw in the underlying engine automatically propagates to all third-party browsers, limiting user choice for alternative privacy implementations. The broader industry might also need to scrutinize how new authentication technologies are implemented, ensuring they don't inadvertently create new privacy bypasses. For users, the immediate takeaway is clear: while Private Relay offers a layer of privacy, it is not foolproof, and a dedicated, full-device VPN remains the most comprehensive option for masking one's true IP address online.