Apple’s iCloud Private Relay service has a privacy problem that can expose a user’s real IP address to websites. The Apple Private Relay IP leak affects sites that support passkeys or pretend to support them, which gives malicious websites a simple way to identify a visitor’s approximate location and internet provider.
Security researchers Tommy Mysk and Talal Haj Bakry discovered the issue while examining how Apple devices handle passkey requests. They found that websites can trigger a network request outside Safari, allowing that request to bypass the protection offered by iCloud Private Relay.
How the Private Relay leak works
Passkeys use the WebAuthn standard to replace traditional usernames and passwords with secure credentials stored on a device. However, part of the process relies on Apple’s operating system credential service, rather than Safari itself.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
Because the operating system sends this request outside Safari, iCloud Private Relay does not route it through Apple’s proxy system. The website receiving the request can therefore see the device’s real IP address, even when the user has enabled Private Relay.
Several WebKit issues contribute to the problem. Since most iPhone and iPad browsers must use Apple’s WebKit engine, the vulnerability affects more than Safari and can also weaken privacy protections in browsers such as OnionBrowser.
The researchers reported the flaw to Apple, and the company reportedly described the issue as serious. However, Apple did not provide a public timeline for a fix before the researchers disclosed their findings.
Users should remember that iCloud Private Relay only protects supported Safari traffic and does not work like a full VPN. Until Apple fixes the flaw, users who need stronger IP protection should avoid unknown websites that request passkey access and consider using a trusted system-level VPN.
Private Relay, VPNs do little to nothing to protect your privacy and identity. They cause more trouble than they’re worth. Can in point ,I started using Private Relay and then couldn’t login to my AT&T account. Why because AT&T was expecting me to login on their network. Turned off PR and tried again. No problem. Same thing when trying to login to my Spectrum internet account.