RESOLVING THE LEDGER
This is one outlet's own report from 9to5Mac — the article as it was filed. Other outlets are covering the same event; open the full story to compare every source side by side.
See the full story · 3 sourcesGo to the 9to5Mac home page Switch site 9to5Toys 9to5Google Logo 9to5Google Electrek Drone DJ Logo DroneDJ Space Explored About Privacy Toggle social menu Toggle dark mode Search for: Submit Toggle search form Forums Store Podcasts Apple@Work Happy Hour 9to5Mac Daily Overtime iPhone iPhone Mac Mac MacBook Pro MacBook Air iMac Mac mini Mac Studio Mac Pro iPad iPad Pro iPad Air iPad mini iPad iPadOS Watch Apple Watch Apple Watch Ultra Apple Health Apple Watch SE Vision Vision Pro visionOS Music and TV Apple Music AirPods HomePod Apple TV Guides Reviews How Tos AAPL Apple Store Apple Arcade Apple Card Apple Silicon Apple One Apple Fitness+ CarPlay Siri HomeKit Toggle dark mode AAPL Company iCloud iCloud Private Relay might be leaking your real IP address, researchers say Chance Miller | Aug 5 2026 - 11:42 am PT 0 Comments Security researchers have discovered a problem with Apple’s iCloud Private Relay service. While the feature is meant to protect your real IP address, it might actually be leaking it to websites.
This iCloud Private Relay vulnerability was discovered by security researchers Tommy Mysk and Talal Haj Bakry, who detailed the problem in-depth on their website .
“In short: any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on,” they say.
As a refresher, iCloud Private Relay is not a VPN. As we’ve explained before, it only protects your IP address in Safari, whereas VPNs protect all traffic from your device by running at the system level.
As 404 Media explains , the problem is due to a series of issues in Apple’s WebKit engine and how it handles passkeys.
In a quirk of how passkeys work — a broadly secure alternative to usernames and passwords which use the WebAuthn standard — a user’s device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user’s real IP address, even though to them it may look like they are simply interacting with a website as normal.
“Because the fetch is issued by the operating system’s credential service rather than by Safari, it never enters Private Relay’s proxied path. The destination server sees the device’s real IP address either way,” the researchers write in their research.
The impact of the problem is worsened on iOS, where all browsers are required to use Apple’s WebKit engine (in most countries):
Because all web browsers on iOS have to use Apple’s WebKit engine, the researchers also found the issues impact at least one Tor browser, called OnionBrowser. The Tor anonymity network routes users’ traffic through multiple nodes located all over the world. But some of the newly discovered issues can expose their IP address too.
Mysk says they reported the problem to Apple, which said it was “dire.” Nonetheless, the company reportedly didn’t provide a timeline on when the problem will be fixed, but agreed to let Mysk disclose it anyway.
You can check whether the problem impacts you via a website set up by the security researchers .
Today’s report follows a separate bug impacting Apple’s Hide My Email feature. This vulnerability, which allowed anyone to access a user’s real email address, was fixed by Apple last month.
Follow Chance : Threads , Bluesky , Instagram , and Mastodon .
FTC: We use income earning auto affiliate links. More.
Check out 9to5Mac on YouTube for more Apple news:
Expand Close comments Expand Close comments Guides AAPL Company Breaking news from Cupertino. We’ll give you t…
iCloud is built into every Apple device, so that…
Chance is the editor-in-chief of 9to5Mac, overseeing the entire site's operations. He also hosts the 9to5Mac Daily and 9to5Mac Happy Hour podcasts.
You can send tips, questions, and typos to [email protected].
AIPROPX is an independent multi-source news index — we track, compare, and connect coverage from across the web into one place you won't find anywhere else.