Apple’s iCloud Private Relay is leaking the IP addresses it’s supposed to hide

Apple markets iCloud Private Relay(nuova finestra) as a way to browse the web without exposing your IP address. A new report from 404 Media(nuova finestra), however, shows that promise is broken.

Security researchers Tommy Mysk and Talal Haj Bakry(nuova finestra) found the underlying flaws in WebKit, the browser engine behind every iOS browser, and built a checker site(nuova finestra) that lets anyone test whether their device is exposed. 404 Media ran that check and confirmed the exploit works.

How the leak works

One of the flaws centers on passkeys, the login standard meant to replace passwords. When a site supports (or just claims to) passkeys, your device makes a credential request through the operating system rather than Safari. That request skips Private Relay’s proxy entirely(nuova finestra), so the site sees your real IP address while everything on screen looks normal and protected.

Because every iOS browser runs on WebKit, the issue also hits OnionBrowser(nuova finestra), an app built to route traffic through Tor (the official Tor Browser(nuova finestra) is unaffected).

Apple says it’s investigating; OnionBrowser’s developer told 404 Media that Apple called the issue “dire” with no fix timeline(nuova finestra).

The second Apple privacy tool to fail in two months

In July, 404 Media reported that Hide My Email, Apple’s disposable-alias feature, had been exposing users’ real addresses for over a year(nuova finestra).

Apple claimed to have fixed the bug twice before actually patching it. The flaw: if a message to a hidden alias bounced as spam, even a legitimate one, the real address could leak into the sender’s mail logs, with no way for the user to know.

It’s the second time in two months a paid iCloud privacy feature has failed, both times caught by outside researchers. It tracks with what we’ve written about Apple’s iPhone privacy claims not holding up to scrutiny.

Private Relay isn’t a VPN substitute

Private Relay only protects Safari, not your whole device. A dedicated VPN encrypts all device traffic, so your real IP never reaches the sites you visit, which is why a VPN you trust still matters even with Private Relay on. Proton VPN’s apps, for example, are open source and independently audited.

The same logic applies to email. If you want to sign up for something without giving out your real address, Proton Mail’s hide-my-email aliases let you do just that.

A privacy feature is only as good as the company willing to catch and fix its own mistakes. Apple has spent years promising “What happens on your iPhone, stays on your iPhone.”(nuova finestra)

Twice in two months, however, that’s proven untrue.