Back to Devoured - August 06, 2026
DEVOURED
Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

Tech securityweb MacRumors
Apple’s iCloud Private Relay service leaks real user IP addresses when websites trigger WebAuthn passkey requests in the background.
What: Researchers Tommy Mysk and Talal Haj Bakry discovered that WebAuthn requests are handled by the system's credential service rather than the Safari browser, bypassing the proxy path. DNS prefetching and WebTransport were also identified as vectors for leaking network information.
Why it matters: This highlights the difficulty of creating 'privacy-preserving' browser features when underlying system-level OS protocols are designed to bypass application-layer proxies.
Takeaway: Users concerned about IP masking should rely on a system-wide VPN until Apple releases a patch, as Safari’s current protections can be bypassed silently by websites.
Decoder
  • iCloud Private Relay: An Apple service that hides a user's IP address and browsing activity from websites and network providers.
  • WebAuthn: A web standard for authenticating users to web-based applications and services using public-key cryptography.
  • DNS prefetching: A technique where a browser resolves domain names before a user clicks a link to reduce latency.
Original article

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.

iCloud Private Relay is a service included with paid iCloud+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.

WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...]

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way.

An attacker who wants to find someone's protected IP can do so by setting up a website that uses WebAuthn. There is no visible passkey prompt and no other indication that an IP address has been accessed in the background.

The researchers also found two other WebKit features that can leak IP addresses and DNS data. DNS prefetching (added in iOS 26) reveals a user's real DNS servers, while WebTransport (added in iOS 26.4) can reveal an IP address.

Apple told 404 Media that it is investigating the report.

Mysk and Haj Bakry created a website to let you test whether Apple's service is leaking your IP address. Since the issue is baked into how WebKit works, some third-party browsers are affected too. Apple will need to address the issue, and in the meantime, users can opt for a VPN for more protection.

Explore all 58 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi