Apple iCloud Private Relay can leak real IP addresses

A security vulnerability in Apple's iCloud Private Relay feature can expose a user's real IP address despite the privacy tool being enabled, according to research published this week. The issue stems from three specific behaviors within Apple's WebKit browser engine, which underpins Safari and all other browsers on iOS. Researchers Talal Haj Bakry and Tommy Mysk detailed the flaws, which can allow network requests to bypass the proxy protections Private Relay is designed to enforce.

The researchers identified three WebKit features that can leak a user's actual IP address: DNS prefetching, WebAuthn-related origin requests used for passkey authentication, and the WebTransport protocol. In each case, certain network requests generated by these features do not route through Private Relay's proxy, instead sending traffic directly from the device and revealing its true network identity. The researchers noted that simply visiting a website that supports passkeys could trigger a leak in some instances, while the DNS and WebTransport exposures depend on whether a visited site utilizes those specific features.

The impact extends beyond Apple's own Safari browser. Because Apple requires...