Analysis
Security researchers Tommy Mysk and Talal Haj Bakry published a set of three WebKit flaws on Tuesday that let a website recover the real IP address of an iCloud+ subscriber who has iCloud Private Relay enabled, according to [404 Media](https://www.404media.co/apples-private-relay-is-exposing-users-real-ip-addresses/), which first reported the findings. The pair built a live test page that demonstrates the bypass rather than describing it in the abstract. Apple told 404 Media it was investigating the report and did not commit to a fix timeline; [TechCrunch](https://techcrunch.com/2026/08/05/psa-apples-private-relay-can-leak-your-real-ip-address/) said Apple did not immediately respond to its own request for comment.
The cleanest of the three paths runs through passkeys. When a site initiates a WebAuthn authentication, the credential request is issued by the operating system's credential service rather than by Safari itself. Private Relay only proxies Safari's own traffic, so the credential fetch leaves the device on the ordinary network path and the destination server sees the subscriber's actual address. Nothing about the flow looks broken to the user -- the padlock, the Private Relay toggle, and the sign-in all behave normally.
Private Relay shipped in 2021 as a paid iCloud+ feature and has always carried a narrower promise than a VPN: it masks IP and DNS only inside Safari, not system-wide. That narrower scope is exactly what makes these flaws awkward. The bypasses live in the seam between Safari and the rest of iOS, and because Apple's App Store rules require every iOS browser to render with WebKit, there is no third-party browser on iPhone that escapes them. OnionBrowser, the Tor-oriented browser for iOS, is affected; the desktop Tor Browser is not.
“Private Relay shipped in 2021 as a paid iCloud+ feature and has always carried a narrower promise than a VPN: it masks IP and DNS only inside Safari, not system-wide.”
The disclosure process is its own story. Mysk and Haj Bakry said they did not report privately first, citing past experience of "months of delays, inconsistent communication, and in some cases, denying the issue's impact entirely." That is an unusual position for researchers with a long Apple track record, and it puts pressure on Apple's security response process as much as on WebKit. It is also the second privacy-feature failure the same researchers have surfaced recently, following a Hide My Email flaw that exposed real addresses.
For anyone building privacy-branded products, the useful lesson is architectural rather than reputational. Private Relay is a browser-scoped proxy in an operating system where an increasing share of network activity -- credential services, push, app-initiated fetches, system telemetry -- happens outside the browser process. Every feature Apple moves out of Safari and into the OS layer widens the surface that a Safari-scoped proxy cannot cover. Competing consumer VPNs from Cloudflare, Proton, and Mullvad interpose at the network layer instead, which is slower and heavier but does not have this class of gap.
The counterweight: this is an IP-address exposure, not an account compromise, and it requires a site that is deliberately looking. No evidence has been published that anyone exploited it in the wild, and the practical harm to a typical user is closer to "an ad network correlated your session" than to a breach. Apple can also close the passkey path server-side in the credential service without a full WebKit rewrite. Treating this as a catastrophic failure overstates it; treating it as cosmetic understates how much Apple charges for the promise.
What to watch: whether Apple ships a fix in the next iOS point release or waits for a major version, and whether it changes its posture toward researchers who bypass private disclosure. If public-first disclosure becomes the norm for Apple privacy features, the company's security-response reputation becomes a product problem, not just a PR one. Watch, too, for whether any regulator in the EU picks this up -- Apple markets Private Relay as a privacy protection people pay for, and a paid feature that underdelivers is the kind of claim consumer-protection authorities have taken up before.
