Mysk: Apple's Private Relay tool can leak users' IP addresses due to issues in Apple's WebKit browser engine, also affecting OnionBrowser, a Tor browser for iOS (Joseph Cox/404 Media)

Apple's Private Relay, a feature that conceals a user's IP address when browsing the web using Safari, has been found to potentially expose the actual IP address due to several bugs. Researchers disclosed these problems in a blog post on Tuesday and created a website where anyone can check if their real IP address is being revealed, even with Private Relay enabled. During a test on Tuesday, TechCrunch confirmed that the site successfully revealed our genuine IP address.

The researchers, Talal Haj Bakry and Tommy Mysk, identified the issue with three components within Apple's WebKit browser engine, which powers Safari and other browsers on iOS. Private Relay is exclusive to iCloud+ subscribers and does not function like a traditional Virtual Private Network (VPN), which secures an individual's IP address at the system level. Instead, Private Relay operates solely within Safari.

Mysk chose not to inform Apple about the flaw due to past negative experiences with the company, which he believes would involve extended delays, inconsistent communication, and in some instances, denial of the issue's significance. Apple has not yet commented on the matter.

Instead, Mysk and his colleagues developed an alternative browser called Psylo, which they claim mitigates the issue by preventing users' IP addresses from leaking when using the software.