# Apple Private Relay can leak real IP addresses, researchers find

**Published:** 2026-08-06T16:15:07.110Z  
**Topic:** Apple News  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/4c2af086-af43-4626-a43d-44a4e9c22c84

Apple Private Relay may expose users' real IPs via WebKit flaws, affecting Safari and other iOS browsers – see the three leak vectors and what to monitor.

Apple’s iCloud + Private Relay feature was shown to reveal users’ real IP addresses in three WebKit‑based scenarios, including passkey logins, DNS prefetching and WebTransport connections, raising concerns for privacy‑focused Safari users and third‑party iOS browsers [1].  

| At a glance | |
|---|---|
| Feature | iCloud + Private Relay |
| Leak vectors | Passkey authentication, DNS prefetch, WebTransport |
| Affected browsers | Safari and any iOS browser using WebKit |
| Apple’s response | Investigating; fix expected autumn 2026 |

## How the leaks occur  
Researchers Talal Haj Bakry and Tommy Mysk identified that when a site requests a passkey, the OS‑level credential service fetches a validation file directly, bypassing Private Relay and exposing the device’s IP to the site—no user interaction is required [3]. A similar bypass happens when WebKit performs DNS prefetching, resolving domain names through the device’s normal network stack and leaking DNS queries. The third bypass uses WebTransport, a newer protocol that opens a direct connection outside the relay chain, also revealing the IP. All three bypasses stem from WebKit behavior, meaning any iOS browser that relies on the engine—including privacy‑focused browsers like OnionBrowser—could suffer the same exposure [2][3].

## Market and competitive implications  
Private Relay was marketed as a privacy layer that masks a user’s IP from both websites and Apple, but it only protects Safari traffic and does not function as a system‑wide VPN [2]. The newly disclosed leaks underscore that the feature cannot guarantee “total invisibility,” a nuance often missed in consumer messaging. Competitors offering full‑device VPNs or dedicated anonymity tools (e.g., Tor Browser on desktop) remain unaffected because they tunnel all traffic at the network level, not just browser traffic. Apple’s reputation for strong privacy is therefore vulnerable to technical scrutiny, echoing a prior Hide My Email issue that took a year to patch after discovery [1][3].

## What to watch  
- **Autumn 2026 patch** – Apple has indicated a fix is slated for release in the autumn quarter of 2026; the exact rollout schedule will determine how quickly the leaks are mitigated.  
- **Third‑party browser updates** – Developers of iOS browsers that rely on WebKit (e.g., OnionBrowser, Psylo) may issue their own patches or work‑arounds, potentially influencing user adoption.  
- **Regulatory attention** – Ongoing scrutiny of privacy claims could prompt regulators to examine whether Apple’s marketing of Private Relay aligns with its technical limitations.

The disclosures highlight that privacy features built into browsers can be undermined by underlying engine behaviors, and that Apple’s next software update will be a key test of its ability to close the gap between marketing promises and technical reality.

## Sources
1. Engadget — [Apple's Private Relay feature could reveal your IP address to websites and services](https://www.engadget.com/2231360/apple-private-relay-feature-could-reveal-your-ip-address/)
2. TechBooky — [Apple Private Relay IP Leak Shows Privacy Tools Have Limits](https://www.techbooky.com/apple-private-relay-ip-leak-webkit-privacy-limits/)
3. The Next Web — [Apple’s Private Relay is supposed to hide your IP. Researchers found three ways it doesn’t](https://thenextweb.com/news/apple-private-relay-ip-leak-webkit-passkeys)
4. Khaleej Times — [Recent data breaches? 7 Apple privacy features every iPhone user should know about](https://www.khaleejtimes.com/business/tech/apple-privacy-features-every-iphone-user-should-know-about)

---
Cite as: TrendWatcher, "Apple Private Relay can leak real IP addresses, researchers find", https://www.trendwatcher.in/article/4c2af086-af43-4626-a43d-44a4e9c22c84