Apple's iCloud Private Relay is Leaking Users' Real IP Addresses - MacRumorsOpen MenuShow RoundupsShow Forums menuVisit ForumsOpen Sidebar
Skip to Content

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

by

Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.

General iCloud App Feature
‌iCloud‌ Private Relay is a service included with paid ‌iCloud‌+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.

WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...]

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way.

An attacker who wants to find someone's protected IP can do so by setting up a website that uses WebAuthn. There is no visible passkey prompt and no other indication that an IP address has been accessed in the background.

The researchers also found two other WebKit features that can leak IP addresses and DNS data. DNS prefetching (added in iOS 26) reveals a user's real DNS servers, while WebTransport (added in iOS 26.4) can reveal an IP address.

Apple told 404 Media that it is investigating the report.

Mysk and Haj Bakry created a website to let you test whether Apple's service is leaking your IP address. Since the issue is baked into how WebKit works, some third-party browsers are affected too. Apple will need to address the issue, and in the meantime, users can opt for a VPN for more protection.

Tag: iCloud
Related Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+

Popular Stories

Apple iCloud Plus expansion hero

iCloud+ Now Includes Apple TV, Apple Arcade, and Curated Apple Music Stations in Over 100 Countries

Tuesday September 15, 2026 1:43 am PDT by
Apple today announced a new subscription initiative that turns paid iCloud+ subscriptions into a broader services bundle in more than 100 countries. In select countries, Apple says every paid iCloud+ plan, including the cheapest 50GB tier, now includes Apple TV and Apple Arcade "at no additional cost," while family sharing extends the storage, TV and Arcade access to up to five people....
Read Full Article • 104 comments
iCloud General Feature Redux

Apple Won't Change Hide My Email Domain After Backlash

Monday August 24, 2026 1:17 pm PDT by
Apple today said it is reversing its decision and will not change the email domain used for the iCloud+ Hide My Email feature. Emails sent using Hide My Email will continue to use the same icloud.com domain that Apple uses for standard iCloud emails. In June, Apple said it would unify the email domains used by Sign in with Apple and Hide My Email under a single private.icloud.com domain....
Read Full Article • 66 comments
iOS 27 Next to iPhone

Here's When iOS 27 Rolls Out Today in Every Time Zone [Update: It's Out]

Sunday September 13, 2026 3:00 am PDT by
Update 10:04 a.m.: iOS 27 is rolling out now, though it may take a bit for all users to see it, so keep checking! Apple is about to release iOS 27, which will finally deliver more advanced Siri AI capabilities as well as a variety of other refinements, improvements, and new features to iPhones. It's Apple's biggest software update of the year, and Apple announced at Wednesday's iPhone event...
Read Full Article • 151 comments

Top Rated Comments

B
bmot
6 weeks ago
Isn’t that a valid legal reason for refunding all users of this subscription fully.
Score: 48 Votes (Like | Disagree)
winxmac Avatar
winxmac
6 weeks ago
First, Hide My Email, and now, Private Relay.
Score: 39 Votes (Like | Disagree)
ghostface147 Avatar
ghostface147
6 weeks ago
Come on man. What is going on here?
Score: 28 Votes (Like | Disagree)
sw1tcher Avatar
sw1tcher
6 weeks ago

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️
Apple says with Private Relay enabled, your privacy is protected, meaning websites cannot see your IP or DNS info

https://support.apple.com/en-us/102602

How Private Relay works

Normally when you browse the web, information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit. This information could be used to determine your identity and build a profile of your location and browsing history over time.

iCloud Private Relay is designed to protect your privacy by ensuring that when you browse the web in Safari, no single party — not even Apple — can see both who you are and what sites you're visiting.



Apple even says if you have problems with some websites, you might need to disable Private Relay so sites can see your real actual IP address.

https://support.apple.com/en-us/102022

Manage iCloud Private Relay for specific websites, networks, or system settings

Some websites, networks, and services might need to see your IP address or require the ability to audit traffic, perform network-based filtering, or view your browsing history.


If Private Relay isn't designed to hide your actual IP, then what is it for then?


https://support.apple.com/guide/iphone/protect-web-browsing-icloud-private-relay-iph499d287c2/ios

When you subscribe to iCloud+, you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. When iCloud Private Relay is on, the traffic leaving your iPhone is encrypted and sent through two separate internet relays. This prevents websites from seeing your IP address and exact location while preventing network providers from collecting your browsing activity in Safari.
Score: 27 Votes (Like | Disagree)
B
bluecoast
6 weeks ago
iCloud private relay says that it will hide your IP address when browsing with Safari/webkit.

So if I land on a web page & my IP address is revealed via webauthn, it's clearly not working as Apple advertises - and they're misleading users as to their privacy.

Apple needs to tell us when a fix is incoming.


I wonder what the devs are working on this week.
More Ariana Grande iMessage stickers.
Score: 22 Votes (Like | Disagree)
D
dominiongamma
6 weeks ago
So much for Apple and privacy.
Score: 18 Votes (Like | Disagree)
Read All Comments