Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

August 06, 2026 August 06, 2026

Apple's iCloud Private Relay: Understanding the IP Address Leak and What It Means for Your Privacy

Apple has long championed user privacy as a core value, often highlighting features designed to protect personal data. One such feature, iCloud Private Relay, is marketed as a way to enhance online privacy by masking your IP address when browsing with Safari. However, recent findings from security researchers Tommy Mysk and Talal Haj Bakry suggest that this promised protection isn't always foolproof. Their research indicates that iCloud Private Relay can, under specific circumstances, inadvertently expose your real IP address to websites, particularly those utilizing or even just pretending to use modern authentication methods like passkeys.

What Exactly is iCloud Private Relay?

To fully grasp the implications of this discovery, it's essential to understand what iCloud Private Relay is and how it's intended to function. Included as part of paid iCloud+ subscriptions, Private Relay is a privacy service specifically designed to work with Apple's Safari browser. Its primary goal is to obscure your internet traffic from network providers and the websites you visit by routing it through two separate internet relays.

Here’s a simplified breakdown of how it’s supposed to work:

First Relay: When you browse with Safari and Private Relay is active, your device first encrypts your traffic and sends it to an Apple-operated server. This server knows your real IP address but only encrypts and forwards your request without seeing your destination.
Second Relay: The encrypted request is then sent to a second relay, operated by a third-party content provider. This second relay generates a temporary, anonymous IP address and forwards your request to the target website. This relay knows the destination website but not your real IP address.
The Outcome: By separating these two pieces of information (your real IP address and the website you're visiting) across different entities, neither Apple, the third-party relay, nor the website itself is supposed to be able to identify both who you are and what you're doing online. This process effectively hides your IP address and your DNS (Domain Name System) information, preventing websites from tracking your online activity based on your location or unique identifier.

It's crucial to distinguish iCloud Private Relay from a full-fledged Virtual Private Network (VPN). While both offer privacy benefits, a VPN typically routes *all* internet traffic from your device through an encrypted tunnel, regardless of the app or browser being used. iCloud Private Relay, on the other hand, primarily focuses on Safari browsing and certain non-browsing traffic (like Mail). This distinction is vital because the leaks discovered by Mysk and Haj Bakry highlight scenarios where traffic *outside* Private Relay's protected path can still expose your data.

The IP Leak Through Passkeys and WebAuthn

The most significant vulnerability identified by the researchers centers around passkeys and the underlying WebAuthn standard. Passkeys represent a new generation of passwordless authentication, aiming to provide a more secure and convenient way to sign into websites and apps. Instead of traditional passwords, passkeys rely on cryptographic keys stored securely on your device.

Understanding Passkeys and WebAuthn

Passkeys: These are digital credentials that allow you to log in to accounts without typing a password. They leverage public-key cryptography, where a unique pair of keys – a public key and a private key – is generated. The private key remains on your device (e.g., iPhone, Mac), and the public key is registered with the website. When you log in, your device uses the private key to prove your identity without ever sending it over the internet.
WebAuthn (Web Authentication): This is an open web standard that enables strong, passwordless authentication using cryptographic keys. It's the technical framework that makes passkeys possible. When a website requests authentication via WebAuthn, it interacts with your device's operating system to handle the credential verification process.

How the Leak Occurs

The core of the problem lies in how WebKit (the browser engine powering Safari and other iOS/iPadOS browsers) handles these WebAuthn requests. According to the researchers, when a website initiates a WebAuthn "ceremony" (the process of authenticating using a passkey), WebKit doesn't manage the entire process itself within Safari's sandboxed environment. Instead, it delegates this task to the operating system's (iOS/macOS) built-in credential service.

This operating system service then directly makes an HTTPS request to the website to complete the authentication process. Crucially, this request is initiated directly from your device and is "unaware of any proxy the host app configured." In simpler terms, the system's credential service bypasses iCloud Private Relay's protective tunnel.

The researchers noted specific technical details that make this leak particularly insidious:

WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...]

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way.

Let's break down those technical terms for clarity:

rpId (Relying Party ID): This is an identifier specified by the website (the "relying party") that the WebAuthn process is interacting with. A malicious website can set this rpId to a server it controls, even if it's not the primary domain you're visiting.
mediation: "conditional": This is a WebAuthn option that allows the authentication process to begin without requiring explicit user interaction, such as clicking a "Login with Passkey" button. If there's a stored passkey for that website (or rpId), the system might attempt to use it in the background.
No UI Ever Appears: This is perhaps the most alarming aspect. Because of mediation: "conditional" and the nature of the request, the user might not see any visible passkey prompt or any indication that an authentication attempt is happening. The IP address leak can occur silently in the background, without the user's knowledge or consent.

This means an attacker could set up a website that uses WebAuthn in a specific way. Even if you don't intend to log in with a passkey, merely visiting their site could trigger a background request from your operating system. Because this request bypasses Private Relay, the attacker's server would then record your true IP address.

Other Identified Leaks: DNS Prefetching and WebTransport

Beyond the passkey vulnerability, Mysk and Haj Bakry uncovered two additional WebKit features that can compromise user privacy by leaking IP addresses and DNS data.

DNS Prefetching (Added in iOS 26)

What is DNS Prefetching? DNS (Domain Name System) is often called the "phonebook of the internet." When you type a website address like "example.com," your device uses DNS to look up the corresponding IP address (e.g., 192.0.2.1) so it can connect to the server. DNS prefetching is a browser optimization technique where the browser proactively resolves the IP addresses of links on a page *before* you even click them. This is done to speed up page loading if you decide to navigate to one of those links.
How it Leaks: While beneficial for speed, the researchers found that DNS prefetching, as implemented, can reveal a user's real DNS servers. If these DNS requests are made outside of Private Relay's protection, they effectively expose information about your network configuration, which can be used to link you to your actual internet service provider (ISP) and thus your general location, undermining the very purpose of Private Relay.

WebTransport (Added in iOS 26.4)

What is WebTransport? WebTransport is a relatively new web API that allows web applications to send and receive data with web servers using low-latency, two-way communication. It's designed for use cases like real-time gaming, live video streaming, or collaborative applications where quick, persistent data exchange is crucial.
How it Leaks: Similar to the WebAuthn issue, the implementation of WebTransport can also bypass Private Relay. When a connection is established using WebTransport, the underlying network request might originate directly from the device's network stack rather than through the proxied path of Private Relay. This direct connection then exposes the device's real IP address to the server it's communicating with, providing another vector for tracking.

Apple's Response and the Broader Implications

Following the disclosure of these findings, Apple told 404 Media that it is actively investigating the report. This is a standard response for security vulnerabilities, indicating that the company is taking the claims seriously and working to understand and potentially address the underlying issues.

The fact that these leaks are "baked into how WebKit works" has significant implications. Since WebKit is the engine that powers not just Safari but also all third-party browsers on iOS and iPadOS (due to Apple's platform requirements), many other browsers on these platforms could also be affected. This means users cannot simply switch to a different browser on their iPhone or iPad to avoid these specific vulnerabilities if those browsers are also relying on WebKit's system-level integrations in the same way.

Why Your IP Address Matters for Privacy

For many users, an IP address might seem like an abstract technical detail. However, it's a critical piece of information for online privacy. Your IP address can:

Reveal Your Location: While not as precise as GPS, an IP address can often pinpoint your city, region, and even your internet service provider. This information can be used to build a profile of your browsing habits tied to your real-world identity.
Enable Tracking: Websites and advertisers use IP addresses as a primary identifier to track your online behavior across different sites. This tracking forms the basis for targeted advertising and content personalization, but it also raises concerns about surveillance and data aggregation.
Facilitate Censorship and Surveillance: In some contexts, governments or organizations can use IP addresses to block access to certain content or to monitor the online activities of individuals.
Increase Security Risks: While less common for the average user, a known IP address can sometimes be a starting point for more sophisticated attacks, such as denial-of-service attempts.

Features like iCloud Private Relay are designed to prevent exactly this kind of data exposure, so any leak directly undermines user expectations of privacy.

Testing for the Leak and User Recommendations

To help users determine if their IP address is being exposed, Mysk and Haj Bakry created a website specifically designed to test for these vulnerabilities. Visiting this site with Private Relay enabled in Safari can provide an indication of whether your real IP is being revealed by these WebKit mechanisms.

While Apple investigates and works on a fix, users who are highly concerned about their online privacy have limited immediate options within the Apple ecosystem:

Consider a Full-Featured VPN: For comprehensive protection that masks all internet traffic from a device, a reputable VPN service remains the most robust solution. Unlike iCloud Private Relay, a VPN typically routes *all* network connections through its encrypted servers, providing a consistent layer of privacy across all apps and browsers. However, choosing a trustworthy VPN provider is crucial, as they will handle all your internet traffic.
Be Mindful of Websites Visited: Exercise caution when clicking on unfamiliar links or visiting websites that seem suspicious, especially those that might be designed to exploit these kinds of vulnerabilities.
Stay Updated: Ensure your Apple devices are always running the latest software versions. Once Apple releases a fix, it will likely come as a software update (iOS, iPadOS, macOS, watchOS).

Apple's Ongoing Commitment to Privacy and the Challenges Ahead

This discovery highlights the complex and ever-evolving nature of online privacy and security. Apple has made privacy a cornerstone of its brand identity, introducing numerous features aimed at giving users more control over their data. iCloud Private Relay itself is a testament to this commitment, offering a novel approach to protect user IP addresses without resorting to a full VPN.

However, the internet is a dynamic environment, constantly introducing new technologies and standards like WebAuthn and WebTransport. Integrating these new functionalities into existing privacy frameworks, especially within a complex system like WebKit, presents significant technical challenges. Ensuring that every piece of communication adheres to privacy expectations requires meticulous design and constant vigilance.

The researchers' findings underscore that even well-intentioned privacy features can have unforeseen loopholes when interacting with the broader web ecosystem. It's a reminder that privacy is not a static achievement but an ongoing battle that requires continuous effort from developers, researchers, and users alike.

Ultimately, Apple will need to address the architectural issues within WebKit that cause these leaks. This might involve re-routing specific system-level requests through Private Relay's proxy, or re-evaluating how WebAuthn and other features interact with the operating system's networking stack. Until then, users should be aware of these limitations and consider additional layers of protection if their privacy demands it.

Conclusion: Staying Vigilant in a Complex Digital World

The revelation that Apple's iCloud Private Relay can leak users' real IP addresses through specific WebKit features is a significant finding. While iCloud Private Relay offers a valuable layer of privacy, these vulnerabilities demonstrate that it's not an impenetrable shield. The ability for websites to silently capture an IP address via passkey-related mechanisms, DNS prefetching, or WebTransport undermines the core promise of the service.

This incident serves as an important reminder that no single privacy solution is perfect. It underscores the critical role of independent security research in identifying and disclosing such flaws, allowing companies like Apple to rectify them and improve user protection. For users, understanding these nuances is key to making informed decisions about their online security. Staying informed, utilizing available testing tools, and considering comprehensive privacy tools like reputable VPNs remain essential steps in safeguarding your digital footprint.

As Apple investigates these reports and works towards a resolution, the focus remains on ensuring that privacy features truly deliver on their promise, protecting users in an increasingly complex and interconnected digital world.

Tag: iCloud

This article, "Apple's iCloud Private Relay is Leaking Users' Real IP Addresses" first appeared on MacRumors.com

Discuss this article in our forums

from MacRumors
-via DynaSage