Apple's Private Relay feature could reveal your IP address to websites and services
Apple's Private Relay feature is supposed to mask your IP address, but researchers found that it doesn't always work due to a WebKit issue.
Intelligence analysis by Llama
Researchers Talal Haj Bakry and Tommy Mysk discovered that Apple's Private Relay feature doesn't always work as intended due to issues with WebKit, which could reveal your IP address to websites and services.
Imagine you're trying to keep your home address a secret from your neighbors. You think you've found a way to hide it, but it turns out that your mailman can still see your address. That's kind of what's happening with Apple's Private Relay feature, which is supposed to keep your IP address secret from websites and services. But researchers found that it doesn't always work, and your IP address could be visible to others. It's like the mailman can still see your address, even though you thought you were hiding it.
Analysis
A WebKit Issue Exposes Your IP Address
Apple's Private Relay feature is designed to ensure that no website or even the company itself can see your IP address when you browse the web on Safari. However, researchers Talal Haj Bakry and Tommy Mysk found that it doesn't always work as intended due to issues with Apple's web browser engine, WebKit. The issue lies in the way passkeys are handled, which are gaining ground as a new secure and password-free login method.
When you use a passkey to log in, your device makes an authentication request outside of the browser itself. Private Relay is an iCloud+ feature bound to Safari and doesn't shield your identity throughout your device like a real VPN does. So, if you log into a website or a service with your passkey on Safari, it could leak your IP.
The possibility of an IP leak isn't confined to Safari either. Since the issue lies with WebKit that's used on all iOS browsers, your IP could also become visible to websites and services if you use passkeys on other browsers designed for privacy and anonymity, like OnionBrowser and the researchers' own Psylo browser.
The researchers said in a post on X that they have already contacted OnionBrowser and the Tor Project, which provides the anonymity network the browser uses, to share their findings and solutions. Apple told 404Media that it's already investigating the researchers' report, but as the researchers said in their post, it could take a lot of time before the company addresses the problem.
A Year-Long Delay in Fixing a Similar Issue
The researchers mentioned the issue with iCloud's Hide My Email, for instance, which another research team discovered in mid-2025. Apple didn't roll out a fix, which would prevent the feature from leaking the real email addresses behind aliases, until a year later. This raises concerns about the company's ability to address security vulnerabilities in a timely manner.
A Call for Responsible Disclosure
The researchers found themselves in a bit of a dilemma with these DNS and IP leaks in WebKit and how to handle them responsibly. They first became aware of a DNS leak in Psylo in late June 2026 after a user reported it. During their investigation, they found two issues that could potentially expose users' IP addresses.
The researchers decided to share their findings with the public, but they also contacted Apple and other relevant parties to share their solutions. They hope that by doing so, they can help prevent similar issues in the future and promote responsible disclosure practices.
Key points
- Apple's Private Relay feature doesn't always work as intended due to issues with WebKit.
- The issue lies in the way passkeys are handled, which could leak your IP address to websites and services.
- The researchers have contacted Apple and other relevant parties to share their findings and solutions.
- Apple is investigating the researchers' report, but it could take a long time before the company addresses the issue.
If Apple addresses the issue with WebKit and fixes the Private Relay feature, users can continue to enjoy a higher level of anonymity online. This could also lead to increased trust in Apple's security features and a more secure online experience for users.
If Apple takes a long time to address the issue, users may continue to be exposed to security vulnerabilities, which could lead to data breaches and other security incidents. This could also damage Apple's reputation and erode user trust in the company's security features.
