Apple Private Relay can leak real IP addresses, researchers find

Apple’s iCloud + Private Relay feature was shown to reveal users’ real IP addresses in three WebKit‑based scenarios, including passkey logins, DNS prefetching and WebTransport connections, raising concerns for privacy‑focused Safari users and third‑party iOS browsers [1].

How the leaks occur

Researchers Talal Haj Bakry and Tommy Mysk identified that when a site requests a passkey, the OS‑level credential service fetches a validation file directly, bypassing Private Relay and exposing the device’s IP to the site—no user interaction is required [3]. A similar bypass happens when WebKit performs DNS prefetching, resolving domain names through the device’s normal network stack and leaking DNS queries. The third bypass uses WebTransport, a newer protocol that opens a direct connection outside the relay chain, also revealing the IP. All three bypasses stem from WebKit behavior, meaning any iOS browser that relies on the engine—including privacy‑focused browsers like OnionBrowser—could suffer the same exposure [2][3].

Market and competitive implications

Private Relay was marketed as a privacy layer that masks a user’s IP from both websites and Apple, but it only protects Safari traffic and does not function as a system‑wide VPN [2]. The newly disclosed leaks underscore that the feature cannot guarantee “total invisibility,” a nuance often missed in consumer messaging. Competitors offering full‑device VPNs or dedicated anonymity tools (e.g., Tor Browser on desktop) remain unaffected because they tunnel all traffic at the network level, not just browser traffic. Apple’s reputation for strong privacy is therefore vulnerable to technical scrutiny, echoing a prior Hide My Email issue that took a year to patch after discovery [1][3].

What to watch

• Autumn 2026 patch – Apple has indicated a fix is slated for release in the autumn quarter of 2026; the exact rollout schedule will determine how quickly the leaks are mitigated.
• Third‑party browser updates – Developers of iOS browsers that rely on WebKit (e.g., OnionBrowser, Psylo) may issue their own patches or work‑arounds, potentially influencing user adoption.
• Regulatory attention – Ongoing scrutiny of privacy claims could prompt regulators to examine whether Apple’s marketing of Private Relay aligns with its technical limitations.

The disclosures highlight that privacy features built into browsers can be undermined by underlying engine behaviors, and that Apple’s next software update will be a key test of its ability to close the gap between marketing promises and technical reality.