Apple iCloud Private Relay Vulnerabilities Confirmed to Leak Real IP Addresses

Apple's privacy feature has been breached using standard web browser functions. Research findings have emerged that security researchers identified three bypass routes in iCloud Private Relay capable of exposing users' real IP addresses and network information. Security experts revealed that this information could be stolen during regular web surfing without the need for separate programs.

The vulnerabilities were discovered by researchers Talal Haj Bakry and Tommy Mysk. It was revealed that standard browser features such as WebKit's DNS prefetching, Passkey-integrated WebAuthn, and WebTransport could be exploited as paths to bypass proxy settings. The research confirmed that two of these techniques could leak the user's actual Internet Protocol (IP) address, while the remaining one could expose the device's active DNS server information.

The researchers explained that while this discovery does not directly expose all of a user's online activities, it does reveal network information that Private Relay was presumed to protect. Details of the vulnerabilities and their scope were disclosed in a Fox News report on August 16, 2026.