Apple's Private Relay tool can leak users' IP addresses — with OnionBrowser also affected
While Apple is looking into it, some browser makers have already made their moves.
Researchers Talal Haj Bakry and Tommy Mysk uncovered three WebKit flaws that inadvertently expose real IP addresses, despite Apple's iCloud Private Relay feature. These vulnerabilities arise from WebKit's DNS prefetching, WebAuthn origin requests, and WebTransport bypass proxy settings. The issues have been identified in iOS versions 26.0, 18.0, and 26.4, respectively.
Private Relay, which is designed to hide user IP addresses and encrypt web traffic, unfortunately does not fully protect users from these leaks. The three affected browsers include Tor and Psylo, both of which have already issued updates to address the problems. However, Apple has not confirmed a patch or indicated any work towards resolving the issue, stating that they are reviewing the researchers' report.
Apple users can verify if the Private Relay feature is functioning correctly by visiting a dedicated website built by the researchers.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Apple's 'Private Relay' Is Exposing Users' Real IP Addresses yro.slashdot.org
- Apple's iCloud Private Relay is Leaking Users' Real IP Addresses macrumors.com
- Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses thehackernews.com
- Apple's iCloud Private Relay feature is leaking users' real IP addresses techspot.com
- Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses 404media.co
