PSA: Apple’s Private Relay can leak your real IP address
Researchers discover flaws in WebKit that allow malicious actors to bypass Apple's Private Relay and expose users' actual IP addresses.
Stock photo for illustration only, not from the actual event
- Apple's Private Relay feature suffers from flaws that can leak real IP addresses.
- Security researchers Talal Haj Bakry and Tommy Mysk uncovered the security issue.
- The underlying problem stems from three features within Apple's WebKit browser engine.
- The researchers bypassed reporting to Apple, citing past frustration and delays.
Users who rely on Apple’s Private Relay to mask their internet browsing activity on Safari may be exposed, as researchers have revealed that the privacy feature can be circumvented to expose a user's supposedly hidden IP address due to multiple architectural flaws.
The security issues were detailed in a blog post, alongside a dedicated website created by the researchers allowing anyone to test whether their real IP address leaks even while utilizing Private Relay. During testing, TechCrunch verified that the site successfully revealed their actual IP address. The issue was initially brought to light by 404 Media.
Talal Haj Bakry and Tommy Mysk, the researchers behind the discovery, noted in their publication that the root cause lies within three distinct features in Apple’s WebKit browser engine, which powers all web browsers on iOS devices. Private Relay is exclusively available to iCloud+ subscribers and functions differently from a standard Virtual Private Network (VPN), as a VPN protects user IPs at the system level whereas Private Relay operates strictly within Safari.
This vulnerability underscores the immense complexity of maintaining user privacy on modern web architectures. Even features built into tightly controlled ecosystems like iOS can harbor edge-case vulnerabilities through underlying engines like WebKit. The decision by researchers to publicly release testing tools instead of following traditional vulnerability disclosure pipelines highlights growing tensions between independent security researchers and major tech platforms over response times and transparency.
Stock photo for illustration only, not from the actual event
Mysk further explained in a post on X that the team intentionally chose to bypass reporting the vulnerability directly to Apple, stating that past experiences with the company involved months of delays, inconsistent communication, and occasional outright denial of the issue's impact.
Apple did not immediately respond to requests for comment regarding the disclosed flaws. Meanwhile, Mysk and his colleagues, who develop a privacy-focused browser named Psylo, stated that their application has already implemented mitigations to prevent user IP addresses from leaking while browsing through Psylo.
Source: TechCrunch
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment