Security researchers have identified vulnerabilities in Apple’s iCloud Private Relay that could expose users’ real IP addresses while browsing in Safari, raising concerns about online privacy.
iCloud Private Relay, a feature available to iCloud+ subscribers, is designed to enhance privacy while browsing in Safari by masking users’ actual IP addresses and locations. However, recent findings by security researchers Talal Haj Bakry and Tommy Mysk reveal that certain WebKit features can bypass this protection, potentially exposing users’ real IP addresses to websites.
The researchers discovered three specific mechanisms that could lead to this privacy breach: DNS prefetching, a WebAuthn feature related to passkeys, and WebTransport. Each of these methods operates differently but can compromise the privacy that iCloud Private Relay aims to provide.
DNS prefetching is a technique used by browsers to speed up the loading of websites by preemptively looking up the addresses of links before users click on them. The researchers found that WebKit can send these DNS requests through the device’s normal DNS connection instead of following the privacy path established by iCloud Private Relay. This means that a website could potentially see DNS requests originating from the user’s actual network, which undermines the privacy protections users expect.
The second issue involves WebAuthn, a web standard that allows passkeys to work across multiple related domains. When a device verifies whether these websites belong together, it may contact a server directly to retrieve a verification file. This request occurs outside of Safari’s normal proxied network path, allowing the destination server to receive the device’s real IP address, even with Private Relay enabled. Importantly, this vulnerability does not imply that attackers can steal passkeys; rather, it exposes the IP address during the verification process.
The third mechanism, WebTransport, enables websites to maintain low-latency connections with servers, which is beneficial for certain interactive web services. However, the researchers found that WebKit can establish a WebTransport connection directly from the device, bypassing the configured proxy. As a result, the server can see the user’s actual IP address, as this connection does not go through the privacy protections of iCloud Private Relay.
These findings are particularly relevant for users who rely on Safari and iCloud Private Relay to conceal their IP addresses. The implications extend beyond Safari, affecting other privacy-focused browsers and applications that utilize WebKit’s proxy configuration. Notably, VPNs do not experience these specific WebKit proxy leaks, as they tunnel network traffic at the system level rather than relying on browser-level configurations.
While the researchers’ findings may raise concerns, users of iCloud Private Relay should not panic or immediately disable the feature. Most browsing activity in Safari still adheres to the privacy architecture established by Private Relay. Apple maintains that the service is designed to prevent websites from accessing users’ IP addresses and exact locations. However, the newly identified WebKit behaviors create exceptions that could allow websites to glean real IP addresses or information about DNS connections.
Although an IP address typically does not reveal a user’s home address, it can disclose information about the internet service provider and approximate location. This information can be used by websites to create a more comprehensive profile of users, which is counterproductive for those who rely on Private Relay for privacy.
Apple has yet to respond to requests for comment regarding these findings. In the meantime, users can take several steps to mitigate the risks associated with these WebKit behaviors. One option is to disable Private Relay, which would eliminate its protections for Safari traffic. Users can check their Private Relay settings by navigating to Settings > [Your Name] > iCloud > Private Relay on their iPhones.
Apple also allows users to choose between maintaining general location information or using only their country and time zone. Keeping iOS, iPadOS, and macOS updated is crucial, as security and privacy fixes are often included in operating system updates. Users can check for updates by going to Settings > General > Software Update, with iOS 26.6 being the latest release as of now.
For those who prioritize hiding their real IP addresses, a reputable VPN may offer a more robust solution. Unlike iCloud Private Relay, VPNs tunnel traffic at the system level, making them less susceptible to the WebKit proxy leaks identified by the researchers. However, it is important to note that a VPN cannot provide complete invisibility online, as websites can still recognize users through account logins, cookies, and other identifiers.
While the findings regarding WebAuthn may sound alarming due to the involvement of passkeys, the researchers clarified that the exposure pertains to network requests rather than the theft of passkeys themselves. Passkeys remain a strong option for protecting accounts from phishing and stolen passwords.
In response to these vulnerabilities, some browser developers, such as Psylo, have already implemented changes to their browsers. Psylo version 1.3.1 now blocks DNS prefetch hints, and WebTransport and WebAuthn are disabled by default. Users can opt to enable these features on a site-by-site basis if needed, demonstrating that browser developers can take proactive measures to address these privacy concerns.
Understanding the limitations of privacy features is essential for users. While iCloud Private Relay offers meaningful protection with minimal effort, it should not be viewed as a complete substitute for a full-device VPN, especially for those who prioritize keeping their real IP addresses hidden. The recent discoveries highlight the importance of transparency regarding privacy protections and the potential vulnerabilities that may exist beneath the surface.
As users consider the implications of these findings, they may question their trust in iCloud Private Relay. Would you continue to use the feature while awaiting a resolution from Apple, or would you seek alternative privacy solutions? Share your thoughts with us at CyberGuy.com.
According to Fox News, the ongoing discourse surrounding online privacy emphasizes the need for users to remain vigilant and informed about the tools they use to protect their personal information.