Apple's iCloud Private Relay is Leaking Users' Real IP Addresses - MacRumors
Skip to Content

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

by

Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.

General iCloud App Feature
‌iCloud‌ Private Relay is a service included with paid ‌iCloud‌+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.

WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...]

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way.

An attacker who wants to find someone's protected IP can do so by setting up a website that uses WebAuthn. There is no visible passkey prompt and no other indication that an IP address has been accessed in the background.

The researchers also found two other WebKit features that can leak IP addresses and DNS data. DNS prefetching (added in iOS 26) reveals a user's real DNS servers, while WebTransport (added in iOS 26.4) can reveal an IP address.

Apple told 404 Media that it is investigating the report.

Mysk and Haj Bakry created a website to let you test whether Apple's service is leaking your IP address. Since the issue is baked into how WebKit works, some third-party browsers are affected too. Apple will need to address the issue, and in the meantime, users can opt for a VPN for more protection.

Tag: iCloud
Related Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+

Popular Stories

iCloud General Feature Redux

Apple Won't Change Hide My Email Domain After Backlash

Monday August 24, 2026 1:17 pm PDT by
Apple today said it is reversing its decision and will not change the email domain used for the iCloud+ Hide My Email feature. Emails sent using Hide My Email will continue to use the same icloud.com domain that Apple uses for standard iCloud emails. In June, Apple said it would unify the email domains used by Sign in with Apple and Hide My Email under a single private.icloud.com domain....
Read Full Article • 66 comments
iPhone Handoff iOS 27 Feature

T-Mobile to Charge $5 a Month for iOS 27 iPhone Handoff

Thursday September 10, 2026 3:58 pm PDT by
T-Mobile will charge customers $5 per month to use iPhone Handoff, an e-SIM feature that allows the same phone number to be used on two separate iPhones. iPhone Handoff requires carrier support, and at launch, only T-Mobile users in the U.S. and Deutsche Telekom users in Germany will be able to use it. T-Mobile says customers can use their number across two compatible iPhone models and...
Read Full Article • 152 comments
iphone duo

IMAX Reacts to iPhone Duo's 1:1.4 Aspect Ratio Displays

Friday September 11, 2026 4:42 am PDT by
Production theater company IMAX has responded in a mixed way to Apple's embrace of a 1:1.4 aspect ratio on the iPhone Duo's inner and outer displays. The boxier ratio happens to be very close to the classic "full-frame" IMAX 1.43:1 aspect ratio, which comes from the geometry of the company's original 15-perforation/70mm film system. In response to an X post from someone wondering if we'll see...
Read Full Article • 74 comments

Top Rated Comments

B
bmot
5 weeks ago
Isn’t that a valid legal reason for refunding all users of this subscription fully.
Score: 48 Votes (Like | Disagree)
winxmac Avatar
winxmac
5 weeks ago
First, Hide My Email, and now, Private Relay.
Score: 39 Votes (Like | Disagree)
ghostface147 Avatar
ghostface147
6 weeks ago
Come on man. What is going on here?
Score: 28 Votes (Like | Disagree)
sw1tcher Avatar
sw1tcher
5 weeks ago

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️
Apple says with Private Relay enabled, your privacy is protected, meaning websites cannot see your IP or DNS info

https://support.apple.com/en-us/102602

How Private Relay works

Normally when you browse the web, information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit. This information could be used to determine your identity and build a profile of your location and browsing history over time.

iCloud Private Relay is designed to protect your privacy by ensuring that when you browse the web in Safari, no single party — not even Apple — can see both who you are and what sites you're visiting.



Apple even says if you have problems with some websites, you might need to disable Private Relay so sites can see your real actual IP address.

https://support.apple.com/en-us/102022

Manage iCloud Private Relay for specific websites, networks, or system settings

Some websites, networks, and services might need to see your IP address or require the ability to audit traffic, perform network-based filtering, or view your browsing history.


If Private Relay isn't designed to hide your actual IP, then what is it for then?


https://support.apple.com/guide/iphone/protect-web-browsing-icloud-private-relay-iph499d287c2/ios

When you subscribe to iCloud+, you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. When iCloud Private Relay is on, the traffic leaving your iPhone is encrypted and sent through two separate internet relays. This prevents websites from seeing your IP address and exact location while preventing network providers from collecting your browsing activity in Safari.
Score: 27 Votes (Like | Disagree)
B
bluecoast
5 weeks ago
iCloud private relay says that it will hide your IP address when browsing with Safari/webkit.

So if I land on a web page & my IP address is revealed via webauthn, it's clearly not working as Apple advertises - and they're misleading users as to their privacy.

Apple needs to tell us when a fix is incoming.


I wonder what the devs are working on this week.
More Ariana Grande iMessage stickers.
Score: 22 Votes (Like | Disagree)
D
dominiongamma
5 weeks ago
So much for Apple and privacy.
Score: 18 Votes (Like | Disagree)
Read All Comments