Serious disclosure: Security researchers have discovered three bugs in WebKit that allow websites to bypass iCloud Private Relay and reveal users' real IP addresses. The issue was publicly disclosed on August 4, 2026 by researchers Tommy Mysk and Talal Haj Bakry, and verified by 404 Media and TechCrunch. It affects all iCloud+ subscribers who trust the service for their privacy in Safari. Apple has been notified, has described the issue as "serious," but has not specified a timeline for a fix. The SecNews technical team explains exactly what's happening, who's at risk, and how to protect yourself.
See also: Strong Ransomware hit Sithonia, Halkidiki and Port Fund
What is iCloud Private Relay?
iCloud Private Relay is an Apple service included with iCloud+ subscriptions and is designed to protect users' privacy when browsing with Safari. It routes traffic through two relay servers in series: the first sees the user's IP address but not the websites they visit, while the second sees the websites but not the IP address. The goal: no one party, not even Apple, can simultaneously link the user's identity to their browsing.
The service is not a VPN. It only covers Safari traffic and certain app requests, not all device traffic. This distinction is critical to understanding the new vulnerability.
Three WebKit vulnerabilities that bypass Private Relay
Researchers identified three distinct bugs in the WebKit engine, which send traffic directly from the user's device, bypassing the proxy setting set by the browser:
- WebAuthn Related Origin Requests: When a website requests a passkey, the operating system's credential management service sends the request directly, not through Safari. Private Relay doesn't even see this request, and the destination server learns the device's real IP address. The issue has been present since iOS 18.0.
- DNS Prefetching: WebKit preemptively resolves domain names via the device's canonical DNS path, revealing the user's actual DNS servers. The issue has existed since iOS 26.0.
- WebTransport: Opens a direct HTTP/3 connection from the device, without using the proxy. The server sees the real IP address. The issue has been present since iOS 26.4.
The most worrying finding concerns passkeys: a malicious website can reveal a user's IP address without any interaction, without any prompt, without any indication. The site only needs to state that it supports passkeys — it doesn't even need to have an actual implementation.
Which users does it affect?
- All iCloud+ subscribers who have Private Relay enabled
- Every iOS browser, as Apple forces all iOS browsers to use WebKit
- OnionBrowser users for iOS, based on the same engine
- Psylo users (official update 1.3.1 has fixed the issue within the app)
The Tor Project's official Tor Browser is not affected in the same way, as it operates outside the WebKit ecosystem. Commercial VPN services are not affected, because they route all device traffic at the operating system level.
Also useful: AISI incident: AI created fake GitHub identities
Apple's stance
According to the researchers’ statement to 404 Media, Apple was notified in a timely manner. Tommy Mysk said: “We already notified them; they said it was a serious issue, but they allowed us to disclose it. They didn’t give a timeline for a fix.” Apple confirmed to TechCrunch that the issue is under investigation.
The response has been criticized as slow, especially considering that last month 404 Media uncovered another bug in the Hide My Emailthat exposed users' real email addresses. Apple was aware of that issue for over a year before fixing it.
How to protect your IP address
Until Apple releases the fix, users who want real protection of their IP must take additional steps:
- Use a device-level VPN: Reliable services like Mullvad, ProtonVPN , or NordVPN cover all device traffic, not just Safari. It's the only tool that truly hides your IP address in all scenarios.
- Test site: Researchers created a page at leaks.psylo.app where you can check if your real IP is leaking even though you have Private Relay enabled.
- Disable Passkeys for sensitive browsing: If you use passkeys, be aware that any website with WebAuthn can see your real IP. For high-privacy browsing, consider temporarily disabling the feature.
- Security updates: Install every iOS update Apple releases immediately. The WebKit engine is updated frequently as part of background security improvements.
- Alternative browsers: The Tor Project's Tor Browser remains the safest option for particularly sensitive browsing.
- Realistic expectations: Remember that Private Relay was never a VPN. Apple never claimed full device-level protection. It was always a light layer of privacy for browsing with Safari.
Disclosure doesn’t mean you should disable Private Relay. It still provides protection in many cases. However, if your real IP is vital (e.g. journalists in sensitive areas, activists, users under geo-restrictions), you shouldn’t rely solely on this service. The SecNews editorial team will update readers as soon as Apple releases an official fix. Sources: Mysk Blog, TechCrunch, MacRumors.
