iCloud Private Relay might be leaking your real IP address, researchers say
Security researchers have discovered a problem with Apple’s iCloud Private Relay service. While the feature is meant to protect your real IP address, it might actually be leaking it to websites.
Apple's iCloud Private Relay service, intended to safeguard users' real IP addresses, may inadvertently expose them, according to security researchers Tommy Mysk and Talal Haj Bakry. Their findings were published on their website, revealing that websites supporting passkeys, a secure alternative to usernames and passwords, can still discern users' genuine IP addresses.
Passkeys function by prompting a device request outside of the browser, circumventing Private Relay and exposing users' actual IP addresses. This issue, attributed to Apple's WebKit engine and its interaction with passkeys, impacts iOS, where all browsers rely on Apple's WebKit engine. The problem extends to the Tor anonymity network via the OnionBrowser app, potentially exposing users' IPs.
Mysk reported the matter to the Tor Project, which considered it "dire," but the company has not set a timeline for the fix. Apple has acknowledged the issue and claims a resolution is in the works for Fall 2026. The researchers also discovered a separate vulnerability in Apple's Hide My Email feature, which was subsequently rectified.
Written by urgent.news from 9to5Mac's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Apple’s Private Relay isn’t always hiding your IP address, researchers say androidauthority.com
