Full Breakdown
iCloud Private Relay Vulnerabilities Expose Real IP Addresses
8/17/2026, 2:45:54 AM
Core Issue: WebKit Features Bypass Private Relay
Security researchers identified three distinct WebKit mechanisms that can sidestep Apple’s iCloud Private Relay when Safari is used. First, DNS prefetching may send look-ups through the device’s native DNS connection instead of the relay, allowing a site to see the user’s actual network path. Second, a WebAuthn request tied to passkey verification can trigger a direct connection that reveals the device’s real IP address, even while Private Relay remains active. Third, WebTransport connections can be established outside the proxy, again exposing the true IP. All three paths operate outside the privacy tunnel that Private Relay normally provides.
Researchers and Scope
The findings were reported by Talal Haj Bakry and Tommy Mysk, who examined WebKit-based browsers on iOS and macOS. Their analysis shows that the leaks affect any Safari user who relies on Private Relay for IP masking, as well as other apps that depend on WebKit’s proxy configuration. By contrast, system-level VPNs tunnel traffic before it reaches WebKit, so the identified leaks do not apply to VPN users.
Potential Impact on Users
When a website exploits one of these mechanisms, it can obtain the user’s real IP address and, in the case of DNS prefetching, information about the DNS servers in use. The IP alone does not disclose a precise home address but can reveal the internet service provider and an approximate geographic region, providing an additional identifier that can be combined with other tracking signals. The researchers emphasized that the WebAuthn issue does not enable theft of passkeys; the privacy exposure is limited to the verification request’s network metadata.
Mitigation Steps
Users are advised to keep Private Relay enabled, ensure their devices run the latest iOS, iPadOS, or macOS releases (the most recent version listed is iOS 26.6), and consider a full-device VPN for stronger IP concealment. Browsers such as Psylo have already released updates (version 1.3.1) that block DNS prefetch hints and disable WebTransport and WebAuthn by default, with the option to re-enable them per site. Adjusting Safari’s Private Relay settings to limit location sharing can also reduce exposure.
Official Response and Outlook
Apple’s public documentation states that iCloud Private Relay is designed to prevent websites from seeing a user’s IP address and exact location during Safari browsing. The company was contacted for comment on the newly documented leaks but had not responded before the article’s publication deadline. The researchers suggest that future operating-system updates may address the identified pathways, and they recommend users stay current with security patches while employing complementary privacy tools.
