Ethical Hacking News
Security researchers have disclosed a serious vulnerability in Apple’s iCloud Private Relay tool, which exposes users' real IP addresses to websites that bypass the relay's security mechanism. Researchers Talal Haj Bakry and Tommy Mysk revealed this issue through WebKit features DNS prefetching, WebAuthn Related Origin Requests, and WebTransport, which enables leak of user IP address without requiring any interaction or using passkeys.
Cybersecurity researchers discovered a vulnerability in Apple's iCloud Private Relay that exposes a user's real IP address.The issue affects DNS prefetching, WebAuthn Related Origin Requests, and WebTransport features in WebKit.A proof-of-concept website is available to test if your real IP address leaks even with Private Relay enabled.Apple has acknowledged the report and is investigating the issue.This is not the first security issue discovered in iCloud Private Relay, following a similar leak found in 2021.
Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users' privacy by routing their Safari web traffic through two relays so that no single third-party, including Apple, can determine where the request is originating from and what sites are being visited. It is available as part of the iCloud+ subscription.
Researchers Talal Haj Bakry and Tommy Mysk found this security issue in three features in Apple's WebKit: DNS prefetching, WebAuthn Related Origin Requests, and WebTransport. These three features bypassed the configured proxy and sent traffic directly from the device, exposing the user's real network. This leak also affects macOS, as well as any other WebKit-based browser that relies on WebKit's proxy configuration APIs.
The problems are caused by DNS prefetching, which resolves hostnames through the device's normal DNS path instead of the proxy set by the browser. WebAuthn Related Origin Requests, which make the operating system's credential service fetch a validation file directly from the device, also cause the leak. WebTransport, which opens a direct HTTP/3 connection and bypasses the proxy, enables websites to view users' real IP addresses even when iCloud Private Relay is enabled.
Mysk explained that any website can configure WebAuthn in a way that causes WebKit to reveal the browser's real IP address, bypassing both proxy configurations and iCloud Private Relay in Safari. He also stated that this does not require user interaction or the use of passkeys. A proof-of-concept (PoC) website named "leaks.psylo[.]app" has been made available for anyone to check if their real IP address leaks, even when Private Relay is on.
Apple was told of this issue and responded by saying it is investigating the researchers' report. This is not the first time security issues have been discovered in iCloud Private Relay. Shortly after the feature was released in 2021, FingerprintJS highlighted a WebRTC-based mechanism that leaked a client's real IP address.
The disclosure comes a little over a month after Cupertino addressed another vulnerability in its Hide My Email service that enabled users' real email addresses to be unmasked under certain conditions, undermining the feature's privacy guarantees. The security issue in iCloud Private Relay has raised concerns about how users can keep their online privacy secure.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-Real-IPs-Through-WebKit-Proxy-Bypasses-A-Security-Threat-in-Apples-iCloud-Private-Relay-ehn.shtml
https://thehackernews.com/2026/08/webkit-proxy-bypasses-can-expose-real.html
Published: Thu Aug 6 08:00:57 2026 by llama3.2 3B Q4_K_M
