Apple's Private Relay Leaks Your Real IP: What to Know

Apple promotes iCloud Private Relay as a privacy layer that hides your real IP address from the websites you visit. However, security researchers have discovered that, under certain circumstances, the protection fails and websites can see your real IP. This finding, disclosed on August 5, 2026, has raised concerns among iCloud+ users and raises questions about the robustness of Apple's privacy features.

What happened?

Researchers Talal Haj Bakry and Tommy Mysk, known for their work in mobile security, found three vulnerabilities in WebKit, the browser engine that Apple uses in Safari and all other browsing apps on iOS and iPadOS. These flaws allow network traffic to be sent directly from the device, bypassing Private Relay's encrypted tunnel, thus exposing the user's real IP address.

According to the technical report published by the researchers, the three problematic features are:

• DNS prefetching: available since iOS 26.0, resolves domain names through the operating system, revealing the user's real DNS servers instead of the proxy's.
• WebAuthn Related Origin Requests: since iOS 18.0, the operating system's credential service makes requests outside the browser, bypassing the proxy and exposing the real IP.
• WebTransport: available since iOS 26.4, opens direct HTTP/3 connections that do not go through the proxy.

These flaws affect not only Safari but any iOS browser, since all must use WebKit. Additionally, the vulnerability also impacts OnionBrowser, a Tor browsing app, though not the official Tor browser. The researchers created a test website for users to check if their IP is leaking.

Why does it matter?

Private Relay is an exclusive feature of iCloud+, Apple's subscription service. Unlike a traditional VPN, Private Relay only protects browser traffic, not that of other apps. Its goal is to prevent websites from tracking users via their IP, a common practice for advertising and tracking. If the real IP leaks, websites can identify the user, their approximate location, and their internet provider, nullifying the protection the service promises.

This discovery is significant because it affects millions of Apple users who trust Private Relay to protect their privacy. Moreover, it underscores that even the most advertised privacy features can have technical vulnerabilities. IP leakage can have serious consequences, such as unwanted tracking, user profiling, and potential targeted attacks.

What will be the consequences?

The consequences of this leak are varied. First, iCloud+ users who rely on Private Relay to maintain their anonymity online could be exposed without knowing it. Second, Apple's reputation as a privacy advocate is tarnished. Although Apple has responded to the report, it has not confirmed when it will release a patch. Meanwhile, users are left in a state of uncertainty.

On the other hand, alternative browsers like Tor and Psylo (Mysk's browser) have already released updates to mitigate the vulnerabilities. This shows that it is possible to fix the problem, but Apple has not yet provided a timeline.

This incident could also have broader implications: regulators and privacy advocates might pressure Apple to be more transparent about its privacy features and their limitations. Additionally, it could generate greater distrust towards proxy-based IP protection services, at a time when online privacy is a growing concern.

What should readers know?

If you are an iCloud Private Relay user, it is important to know that your real IP might be visible to some websites, especially those that use passkeys (WebAuthn) or that enable DNS prefetching. Although Apple is aware of the problem, there is no official temporary solution. In the meantime, you can take some measures to mitigate the risk:

• Disable Private Relay if your IP privacy is critical to you, and use a trusted VPN that routes all device traffic.
• Use alternative browsers that have already fixed the flaw, such as Tor or Psylo, though remember that on iOS all browsers use WebKit, so mitigation is partial.
• Monitor Apple updates and apply patches as soon as they are available.

It is also advisable to check the verification site created by the researchers to see if your device is leaking your IP. However, keep in mind that such tests may have privacy implications themselves.

"Privacy is not a switch that turns on or off; it is a continuous process of risk assessment and mitigation," commented a security analyst consulted by TheVortiq.

Historical context and comparison

This is not the first incident of this kind. In 2021, when Apple launched Private Relay, some experts pointed out that it was not a VPN and had limitations. In 2023, a bug was discovered that allowed websites to bypass IP protection using WebSocket techniques. This new finding reinforces the idea that proxy-based privacy features are complex and can fail in unexpected ways.

Compared to other privacy failures in the industry, such as Zoom's error that sent data to Facebook or the Cambridge Analytica scandal, this incident is on a smaller scale, but it underscores the difficulty of guaranteeing privacy in a closed ecosystem like Apple's.

Analysis and speculation

Apple has not yet confirmed when it will fix the problem, but it is likely working on a patch for WebKit. Given that the vulnerabilities affect recent versions of iOS, it is possible that the fix will come in a security update. However, there is no guarantee that Apple can fix all leak paths without redesigning parts of WebKit, which could take time.

Speculation: it is possible that Apple will take advantage of this incident to improve communication about Private Relay's limitations and offer a more robust alternative, such as a full VPN mode in iCloud+.

Conclusion

The IP leak in Private Relay is a reminder that no privacy technology is perfect. Users should be aware of the limitations and make informed decisions. Until Apple releases a patch, caution is key. Stay tuned for updates and consider alternatives if your privacy is paramount.