RESOLVING THE LEDGER
This is one outlet's own report from Engadget — the article as it was filed. Other outlets are covering the same event; open the full story to compare every source side by side.
See the full story · 4 sources
It’s supposed to mask your IP address, but researchers found that it doesn’t always work due to a WebKit issue.
Stockcam/Getty Images Apple's Private Relay feature is supposed to ensure that no website or even the company itself can see your IP address when you browse the web on Safari. But according to security researchers Talal Haj Bakry and Tommy Mysk, it doesn't always work as intended due to issues with Apple's web browser engine, WebKit.
The possibility of an IP leak isn't confined to Safari either. Since the issue lies with WebKit that's used on all iOS browsers, your IP could also become visible to websites and services if you use passkeys on other browsers designed for privacy and anonymity, like OnionBrowser and the researchers' own Psylo browser.
The researchers said in a post on X that they have already contacted OnionBrowser and the Tor Project, which provides the anonymity network the browser uses, to share their findings and solutions. Apple told 404Media that it's already investigating the researchers' report, but as the researchers said in their post, it could take a lot of time before the company addresses the problem. They mentioned the issue with iCloud's Hide My Email , for instance, which another research team discovered in mid-2025. Apple didn't roll out a fix, which would prevent the feature from leaking the real email addresses behind aliases, until a year later.
We found ourselves in a bit of a dilemma with these DNS and IP leaks in WebKit and how to handle them responsibly.
We first became aware of a DNS leak in Psylo in late June 2026 after a user reported it. During our investigation, we found two... https://t.co/5kFu0jtUsJ
— Mysk 🇨🇦🇩🇪 (@mysk_co) August 5, 2026
AIPROPX is an independent multi-source news index — we track, compare, and connect coverage from across the web into one place you won't find anywhere else.