Apple's Private Relay: A Privacy Promise Undermined by WebKit Flaws

Apple's Private Relay, an opt-in feature designed to hide a user's IP address when they browse the internet with Safari, can be circumvented to reveal the supposedly hidden IP address due to a series of flaws.

Researchers Talal Haj Bakry and Tommy Mysk revealed the issues in a blog post on Tuesday. The researchers also set up a website where anyone can check if their real IP address leaks, even if they use Private Relay. In a test on Tuesday, TechCrunch verified that the site was able to reveal our real IP address. The issue was first reported by 404 Media.

The Three Flaws in WebKit

The problem lies with three features in Apple's web browser engine WebKit, which is used by all browsers in iOS. Private Relay is only available to iCloud+ subscribers, and is not like a Virtual Private Network, or VPN, which protects someone's IP address at the system level. Private Relay only works while using Safari.

1. The Passkey Bypass

The most significant vulnerability centers on passkeys, the login standard meant to replace passwords. When a site supports or even just pretends to support passkeys, your device makes a credential request through the operating system rather than Safari.

In short: any website that supports, or pretends to support, passkeys can see the user's real IP address despite having iCloud Private Relay on.

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way. Attackers can simply build a website that supports WebAuthn to potentially obtain a user's real IP address without any noticeable prompts or pop-ups.

2. DNS Prefetching

Researchers also revealed that a DNS prefetching feature introduced in iOS 26 could expose the user's real DNS server information.

3. WebTransport

Additionally, the WebTransport feature introduced in iOS 26.4 also poses an IP address leakage risk.

Impact Beyond Safari

Because all web browsers on iOS have to use Apple's WebKit engine, the researchers also found that the issues impact at least one Tor browser, called OnionBrowser. The Tor anonymity network routes users' traffic through multiple nodes located all over the world, but some of the newly discovered issues can expose their IP address too. Mysk says they reported the problem to the Tor Project, which said it was "dire".

A Troubling Pattern

This is the second time in two months a paid iCloud privacy feature has failed, both times caught by outside researchers. In July, 404 Media reported that Hide My Email, Apple's disposable-alias feature, had been exposing users' real addresses for over a year. Apple claimed to have fixed the bug twice before actually patching it.

Apple's Response

Apple has acknowledged the report and says it's investigating. Mysk filed a security report with Apple, the status of which currently says a fix is planned for Fall 2026.

However, Mysk wrote in a post on X that they chose not to report the issue to Apple because "our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue's impact entirely".

The Researchers' Alternative

Mysk and his colleagues developed a private browser called Psylo, which they say now has mitigations that prevent users' IP addresses from leaking when using Psylo. The researchers have also created a test website where anyone can check if their real IP address leaks, even if they use Private Relay.

What Users Should Know

• Private Relay is not a VPN: It only protects Safari traffic, not all device traffic. A dedicated VPN encrypts all device traffic, so your real IP never reaches the sites you visit.

• The issue affects all iOS browsers because all iOS browsers are required to use WebKit; alternative browsers face the exact same exposure.

• Passkey support can trigger the leak: Any website that supports or pretends to support passkeys could expose your IP address.

Until Apple fixes the issue, users with high privacy needs should consider using a traditional VPN for more comprehensive protection.