Apple's Private Relay Vulnerable to IP Address Leaks

WHO:

404 Media - Security researcher Tommy Mysk stated, “In short: any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on.”

404 Media - Mike Tigas, the creator of OnionBrowser, described the issue as “dire” and noted that Apple did not provide a timeline for addressing it.

404 Media - Security researcher Tommy Mysk stated, “Because the fetch is issued by the operating system’s credential service rather than by Safari, it never enters Private Relay’s proxied path. The destination server sees the device’s real IP address either way.”

404 Media - Mike Tigas, the creator of OnionBrowser, described the issues as “entirely based on how iOS and WebKit work and solely in Apple's hands.”

404 Media - Mike Tigas, the creator of OnionBrowser, described the issue as “dire” and noted that Apple did not provide a timeline for addressing it.

Techmeme - Researchers identified issues with Apple's Private Relay tool and its WebKit browser engine.

TechCrunch - Apple is the organization involved in the implementation of the Private Relay feature.

WHAT:

404 Media - The researchers developed a site that lets Private Relay users check if the issues impact them; tests showed that the site returned the real IP address of a user that was supposed to be protected by Private Relay.

404 Media - The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products, following a bug in Apple’s Hide My Email feature that revealed users’ real email addresses.

CNET - A bug in Apple's Private Relay feature can leak users' real IP addresses due to issues with passkey technology, which is intended to provide more secure authentication.

404 Media - The researchers developed a site that allows Private Relay users to check if their IP address is exposed; tests showed that the site returned the real IP address of a user who was supposed to be protected by Private Relay.

404 Media - The Private Relay leak is the second issue affecting Apple’s paid privacy products, following a bug in Apple’s Hide My Email feature that revealed users’ real email addresses; Apple was aware of that issue for over a year before addressing it.

404 Media - Researchers found that a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have already collected this information incidentally.

404 Media - Apple is investigating the researchers’ report regarding the vulnerabilities in Private Relay.

404 Media - Researchers developed a site that allows Private Relay users to check if their IP address is exposed; tests showed that the site returned the real IP address of a user who was supposed to be protected by Private Relay.

404 Media - The Private Relay leak is the second issue affecting Apple’s paid privacy products, following a bug in Apple’s Hide My Email feature that revealed users’ real email addresses.

Techmeme - Apple's Private Relay tool can leak users' IP addresses due to vulnerabilities.

TechCrunch - A bug in the implementation of Apple's Private Relay feature can reveal users' real IP addresses.

WHERE:

Techmeme - The issues affect users of Apple's Private Relay and OnionBrowser, a Tor browser for iOS.

WHY:

Techmeme - The vulnerabilities in the WebKit browser engine lead to the failure of Private Relay in protecting users' real IP addresses.

HOW:

404 Media - The issues impact at least one Tor browser, called OnionBrowser, due to the requirement for all web browsers on iOS to use Apple’s WebKit engine.

404 Media - The issues with Private Relay are "entirely based on how iOS and WebKit work and solely in Apple's hands," according to Mike Tigas, the creator of OnionBrowser.

404 Media - The issues impact at least one Tor browser, called OnionBrowser, due to the requirement for all web browsers on iOS to use Apple’s WebKit engine.

404 Media - The researchers found that a web request made by a user’s device outside of the browser bypasses Private Relay, exposing the real IP address.

Techmeme - The method of implementation of the Private Relay feature is flawed, allowing for IP address leaks.

(UPDATED August 6, 2026 11:21 UTC)

Security researcher Tommy Mysk has revealed that any website claiming to support passkeys can still see a user's real IP address, even when using iCloud Private Relay. Mike Tigas, the creator of OnionBrowser, called the situation "dire," as Apple has yet to provide a timeline for fixing the problem, which also affects users of at least one Tor browser due to the reliance on Apple's WebKit engine. Researchers have developed a site to help Private Relay users determine if they are impacted, and tests confirmed that the site exposed real IP addresses, marking this leak as the second privacy issue for Apple following a recent bug in its Hide My Email feature.

(UPDATED August 6, 2026 08:17 UTC)

A bug in Apple's Private Relay feature has been discovered, potentially leaking users' real IP addresses due to problems with passkey technology meant to enhance security. Researchers have created a site that allows users to check if their IP address is exposed, and tests revealed that it returned the actual IP address of users who were expected to be protected by Private Relay. This leak marks the second privacy issue for Apple’s paid products, following a similar problem with the Hide My Email feature, which Apple reportedly knew about for over a year before taking action.

(UPDATED August 6, 2026 05:05 UTC)

Researchers have uncovered vulnerabilities in Apple's Private Relay that allow malicious attackers to potentially discover a user's real IP address, with some websites reportedly having collected this information inadvertently. Security researcher Tommy Mysk explained that because the fetch is issued by the operating system’s credential service, it bypasses Private Relay’s protections, while Mike Tigas, the creator of OnionBrowser, emphasized that the issues stem from how iOS and WebKit function. Apple is currently investigating these findings, which notably affect at least one Tor browser due to the mandatory use of its WebKit engine for all web browsers on iOS.

(UPDATED August 5, 2026 20:34 UTC)

A significant security issue has been uncovered regarding Apple's iCloud Private Relay, as security researcher Tommy Mysk revealed that any website claiming to support passkeys can still access a user's real IP address, even with Private Relay enabled. Mike Tigas, the creator of OnionBrowser, described the situation as "dire," noting that Apple has not provided a timeline for fixing this vulnerability, which follows a previous bug in the Hide My Email feature that exposed users' real email addresses. Researchers have created a site that allows users to check if their IP address is being leaked, and tests have confirmed that requests made outside of the browser can bypass Private Relay, revealing the user's actual IP address.

(UPDATED August 5, 2026 18:30 UTC)

Researchers have uncovered vulnerabilities in Apple's Private Relay tool and its WebKit browser engine, which can lead to users' real IP addresses being exposed. The issues affect not only users of Private Relay but also those using OnionBrowser, a Tor browser for iOS. These flaws in the implementation of the Private Relay feature stem from weaknesses in the WebKit engine, compromising the intended privacy protections.