An iCloud Private Relay IP leak report from researchers Talal Haj Bakry and Tommy Mysk says three WebKit features can send some traffic outside Apple’s Safari privacy relay. The reported bypasses are conditional on particular web features, not evidence that every Private Relay browsing session reveals a user’s address. Still, a site that invokes the relevant functions could receive a device’s actual IP address in two cases, according to the researchers.
Apple told 404 Media it was investigating the report. The record so far does not establish that Apple has issued a WebKit or Private Relay fix.
Private Relay is included with iCloud+. Apple says it protects Safari browsing by sending requests through two relays: Apple operates the first, and a third-party content provider operates the second. The intended arrangement means no one party can see both the person making the request and the website being visited. It is a Safari-specific service, not a system-wide VPN.
How does the iCloud Private Relay IP leak work?
Mysk and Haj Bakry say the problem lies in activity that occurs outside WebKit’s standard page-loading path, allowing it to skip proxy routing. Their report identifies three distinct mechanisms:
- DNS prefetching: A webpage can ask the browser to resolve a hostname in advance. The researchers say WebKit sends that lookup through the device’s regular DNS route rather than its proxy. This exposes DNS activity and the device’s network path to the hostname’s authoritative DNS server, rather than directly disclosing the device IP to the webpage.
- WebAuthn Related Origin Requests: This passkey-related process has the operating system credential service retrieve a validation file for another domain. The researchers say that fetch bypasses Private Relay and exposes the device’s real IP address to the destination server.
- WebTransport: The web transport feature can open a direct HTTP/3 connection, which the researchers say likewise reveals the device’s actual IP address.
WebAuthn is the standard that supports passkeys. Related Origin Requests let an organization use a passkey across a limited set of its domains, but the validation check is where the researchers say the traffic takes a different route.
According to Mysk and Haj Bakry, the WebAuthn behavior has been available since iOS 18.0, DNS prefetching since iOS 26.0, and WebTransport since iOS 26.4. Their findings cover proxy-configured WebKit browsers on iOS and macOS as well as Private Relay. On iOS, where Apple requires browsers to use WebKit, that scope also reaches proxy-based browsers, the researchers said.
Who is affected and what is fixed?
The researchers said they notified the Tor Project and the developers of Onion Browser, an iOS browser that uses the Tor anonymity network. They also maintain the proxy browser Psylo and say Psylo 1.3.1 blocks DNS-prefetch hints while disabling WebTransport and WebAuthn by default, with per-site controls to re-enable them. That is a first-party account of Psylo’s mitigation, not an Apple advisory.
Mysk and Haj Bakry say system-level VPNs are not affected by these specific bypasses because they tunnel device traffic at the operating-system level. That is narrower than a promise of complete privacy. Apple’s own documentation describes Private Relay as a two-relay protection for Safari, and says the feature is unavailable in some countries and regions.
404 Media reported that its test of the researchers’ diagnostic page returned the real IP address of a Private Relay user. Readers should treat any such diagnostic as a researcher-provided test of the reported conditions, not a guarantee that a device is secure or exposed in every circumstance.
This story draws on original reporting from 404 Media.
