Apple iCloud Private Relay Bypass Exposes Users’ Real IP Addresses

Security researchers Talal Haj Bakry and Tommy Mysk disclosed that Apple’s iCloud Private Relay can be bypassed, allowing websites to learn a user’s real IP address even when Safari’s privacy feature is enabled. The researchers said the leak stems from multiple WebKit behaviors, including WebAuthn flows tied to passkeys, DNS prefetching in iOS 26, and WebTransport in iOS 26.4. Because the issue is rooted in WebKit, the exposure can also affect some third-party browsers on iOS, not just Safari.

The researchers published a blog post and a public test site demonstrating that sites using or even imitating passkey-related prompts can trigger network requests outside Private Relay’s proxied path, exposing the device’s actual IP address and, in some cases, real DNS infrastructure without obvious user interaction. TechCrunch said it verified the leak during testing, while Apple told another outlet it is investigating the report; Private Relay remains an opt-in feature for iCloud+ subscribers and protects Safari traffic rather than providing system-wide coverage like a VPN.