Two security researchers recently disclosed a significant vulnerability in Apple’s iCloud Private Relay, where even when using Safari, websites can still obtain users’ real IP addresses in a relatively simple way, effectively bypassing the core protection mechanism of this paid privacy feature.
Researchers have found that iCloud Private Relay may leak IP addresses even when using the Safari browser.
This vulnerability was discovered by Talal Haj Bakry and Tommy Mysk. According to 404 Media’s reportResearchers have reported the issue to Apple, and the company acknowledged the vulnerability is “quite serious,” but still allowed the researchers to disclose details and did not provide a timeline for a patch. This approach shows Apple wants users to be aware of the risk, and also hints that a fix may take a longer time.
To understand the root cause of the vulnerability, you first need to understand the design of iCloud Private Relay. This feature can hide a user’s IP address in Safari, but it is not a VPN and does not handle all of the device’s network traffic. More critically, it only protects requests made within Safari. Passkey (a login method that replaces passwords with biometric authentication) uses the WebAuthn framework, which operates outside the browser. Therefore, when a website requests Passkey credentials, such requests do not go through Private Relay, and the website can directly obtain the user’s real IP address.
The average user is almost certainly unaware of such technical details. You might think that simply using Safari and enabling iCloud+ Private Relay would prevent IP exposure, but research has shown that certain websites can easily bypass this protection through specific types of requests. The researchers even builtProof of concept websiteallowing users to check for themselves whether their browser is affected. Besides Safari, any browser that relies on WebKit proxy relay may also be affected, including some versions of the Tor Browser.
It remains unclear when Apple will release a fix. Previously, the “Hide My Email” feature had a vulnerability that exposed real email addresses, and Apple quickly patched it after it came to light, but that only required a server-side update. In contrast, the Private Relay issue involves device-side network behavior and may require a system update to fully resolve.
It is worth emphasizing again that iCloud Private Relay is not a VPN. Traditional VPNs reroute all network traffic from the entire device and provide more comprehensive network-level protection; Private Relay is limited to Safari, offering only restricted coverage. This difference is exactly why the vulnerability occurs: when websites issue certain requests that execute outside the browser stack, Private Relay cannot intervene, and the IP address may be exposed.
Overall, this finding highlights the complexity of privacy tools in cross-platform, cross-protocol environments. Apple’s decision to allow researchers to disclose the issue early shows it wants users to stay alert, and also implies that fixes may take time. For users, the most important thing is to understand the limitations of Private Relay and consider alternatives such as VPN when more comprehensive network privacy is needed.
Source: KOCPC Chinese