Apple iCloud Private Relay could leak your real IP address, security researchers warn

Apple rolled out iCloud Private Relay in 2021 with iCloud+ to make Safari browsing more private. The feature is supposed to hide a user’s IP address and DNS information so websites cannot easily figure out who is visiting them or track their activity online. But according to a new report, that protection may not be foolproof in every situation.

Security researchers Tommy Mysk and Talal Haj Bakry say they have found multiple issues in WebKit, Apple’s browser engine, that could reveal a user’s real IP address even when iCloud Private Relay is enabled. Their findings, first reported by 404 Media and published in detail on the Mysk Blog, suggest that some web technologies can bypass the privacy feature under certain conditions.

Three WebKit features are reportedly responsible

According to the researchers, the problem is linked to three WebKit features — WebAuthn, DNS prefetching, and WebTransport. These features can reportedly make network requests outside WebKit’s normal proxy route, allowing websites to see a user’s real IP address or DNS information.

The biggest concern is WebAuthn, the web standard that powers passkeys. Instead of Safari handling these requests, the operating system’s credential service directly contacts the destination server. Since that request does not travel through iCloud Private Relay, websites supporting passkeys may be able to identify a visitor’s real IP address despite the privacy feature being enabled.

The researchers also claim that this process can happen without displaying a visible passkey prompt in certain situations, making it difficult for users to know that such a request has been made in the background.

DNS prefetching and WebTransport are also part of the problem

Apart from WebAuthn, the researchers say two other WebKit features could also reduce the effectiveness of iCloud Private Relay.

One of them is DNS prefetching, which was introduced in iOS 26. According to the report, DNS prefetching doesn’t always go through iCloud Private Relay. Instead, it reportedly relies on the device’s regular DNS path to resolve website addresses. As a result, websites could learn which DNS server a user is relying on.

Meanwhile, WebTransport, which arrived with iOS 26.4, can reportedly establish direct HTTP/3 connections from the device. According to the researchers, these connections may bypass the configured proxy and reveal the device’s actual IP address.

The researchers say these issues affect WebKit-based browsers on iOS and macOS that use the WKWebsiteDataStore.proxyConfigurations API to route web traffic.

Apple is investigating the findings

Unlike iCloud Private Relay, VPN services are reportedly not affected because they route all internet traffic through an encrypted tunnel at the operating system level rather than relying on browser-level proxying.

The researchers said they informed Apple about the vulnerabilities before making their findings public. They have also created a proof-of-concept website that allows users to check whether their IP address is being exposed through these WebKit behaviours.

Add Techlusive as a Preferred Source

According to 404 Media, Apple has acknowledged the report and said it is investigating the findings. Since the issue is tied to how WebKit handles certain requests, some third-party browsers that rely on Apple’s browser engine could also be affected until a fix is released.