Apple’s iCloud Private RelayiCloud Private Relay) is a Safari privacy feature exclusive to iCloud+ paying subscribers, claiming to hide users’ IP addresses and DNS queries. However, security researchers have recently discovered three vulnerabilities in the WebKit core that can bypass proxy settings and directly leak users’ real IP addresses. Apple has only said it is “investigating” and has not yet provided any timeline for a fix.
iCloud Private Relay found to have three privacy vulnerabilities that leak users’ real IP addresses
How does iCloud Private Relay work?
iCloud Private Relay is designed as a two-hop proxy: Safari’s web traffic and DNS queries are first sent to Apple’s first proxy server, then relayed to the destination website by a second proxy server. Each hop holds only part of the information, with the design goal that no single party (including Apple) can simultaneously know both the user’s identity and the websites they visit. This mechanism only protects Safari traffic, leaving other browsers and apps entirely unprotected—a fundamental difference from VPNs, which protect the entire device at the system level.
This seemingly airtight design had a flaw exposed in this research. Security researchers Tommy Mysk and Talal Haj Bakry were originally investigating DNS leak issues in their own privacy browser, Psylo. Users had reported that DNS queries only leaked when visiting certain websites, and not every site triggered the issue. After digging deeper, the two discovered the source of the leak lay in three vulnerabilities deep within WebKit, unrelated to Psylo’s own code. These vulnerabilities allowed specific traffic to bypass the browser’s configured proxy server and be sent directly from the device itself.
Three proxy bypass vulnerabilities
The first vulnerability is DNS prefetching. A website can place in the page <link rel="dns-prefetch"> Tags that ask the browser to resolve specific domain names ahead of time to speed up connections. When WebKit performs this resolution, it uses the device’s normal DNS path, completely ignoring the proxy configured in the browser. An attacker only needs to embed a unique domain name for each visitor in a webpage to observe queries coming from the visitor’s real network on their own DNS server. This feature was previously ignored on iOS, and was only enabled starting with iOS 26 (September 2025).
The second vulnerability concerns passkey login. Passkeys use the WebAuthn standard, and the authentication process is handled by the operating system’s credential service, which sends HTTPS requests directly to the website without going through the browser’s proxy settings. The researchers point out that a webpage can set rpId to any domain and, combined with conditional mediation mode, the request is silently sent in the background without requiring any user interaction. Furthermore, the Related Origin Requests mechanism allows organizations to share passkeys across a set of their own domains. When a webpage requests credentials from another domain, the system first fetches https:///.well-known/webauthn to verify identity; this verification request also bypasses the proxy, providing another channel for IP leakage. In other words, an attacker only needs to set up a website that uses WebAuthn to obtain the real IP without the victim’s knowledge, and no passkey prompt appears on the screen. For ordinary users, this means the attack could be triggered during routine browsing, and the risk is not limited to occasions where they deliberately sign in with a passkey.
The third vulnerability is WebTransport. This is a communication protocol with lower latency than WebSocket, using HTTP/3 and QUIC. When calling new WebTransport(url), it establishes a QUIC connection directly from the device. WebKit creates the connection using its own network parameters, which likewise does not apply proxy settings. WebTransport was only officially made available in iOS 26.4 (March 2026).
The impact is more widespread than imagined.
Apple’s App Store policy requires all iOS browsers to use the WebKit engine, so the three vulnerabilities affect more than just Safari. All iOS browsers that rely on WebKit’s proxy mechanism are affected, including Tor Browser for iOS, Onion Browser, and Psylo, which the researcher developed themselves. The researcher said the issues have been reported to the Tor Project and the Onion Browser developers, and whether they will each offer their own mitigations remains to be seen. The only exception is Onion Browser: under Silver security level, it enables lockdown mode, which directly disables WebTransport, so it is not affected by the third vulnerability.
VPNs are unaffected. A VPN tunnels all of a device’s network traffic at the system level, which is fundamentally different from a browser-level proxy mechanism, so none of the three vulnerabilities affect the VPN’s scope of protection. The researchers also emphasized that the root cause of the vulnerabilities lies in WebKit’s design and architecture, requiring a complete re-evaluation of the entire proxy mechanism’s design and architectural-level fixes that cannot be resolved quickly with a single update.
In response to this vulnerability, Apple said it is investigating, but did not reveal any timeline for a fix. What’s more unsettling to outsiders is that this is the second time in a short period that a paid Apple privacy feature has had a problem. Last month, the Hide My Email feature could leak users’ real email addresses, and Apple had known about the issue for over a year before finally fixing it after a long delay. With that track record, it’s hard to be optimistic about how quickly Private Relay will be patched.
Additionally, Private Relay only protects Safari traffic—it doesn’t cover other browsers or apps. Users who think enabling Private Relay means whole-device privacy protection may be overestimating its scope.
What should the user do?
The researcher provided an online testing website. leaks.psylo.appUsers can test their own devices to see whether IP and DNS information is leaked. If the test results show a leak, researchers recommend temporarily switching to a VPN as an alternative, since once a VPN is turned on, it protects all traffic, unlike Private Relay, which is limited to Safari.
Researchers remind that Private Relay is designed to prevent websites and telecom operators from building user profiles, serving as an auxiliary anti-tracking mechanism rather than a full anonymity tool. If users need stronger protection in sensitive situations, such as connecting to public Wi-Fi or conducting financial transactions, it is still recommended to use a VPN in addition to enabling Private Relay; combining the two can cover traffic outside Safari.
Researcher’s own browser Psylo has already fixed it in version 1.3.1: it blocks dns-prefetch hints by default, disables WebTransport and WebAuthn, and users with real needs can manually re-enable them for individual sites. The key points to watch next are when Apple will follow suit and how it will close the three vulnerabilities at the WebKit level.
Source: KOCPC Chinese