Apple iCloud Private Relay WebKit Flaws Leak Users’ Real IP Addresses

Cybersecuritynews •Tushar Subhra Dutta • August 6, 2026

Apple users who rely on iCloud Private Relay to conceal their online location may not be getting the protection they expect. Newly disclosed flaws in WebKit, the browser engine used across iOS, can allow a website to see a visitor’s real IP address. The exposure weakens a privacy safeguard. The issue can be triggered when […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apple's Private Relay Vulnerability Exposes Users' IP Addresses Security researchers have discovered that Apple's iCloud Private Relay can inadvertently expose users' real IP addresses due to flaws in how passkeys are processed. This issue arises when requests bypass Safari's proxy protections, allowing websites to see the user's actual IP address. The researchers, Tommy Mysk and Talal Haj Bakry, created a testing site demonstrating the leak. They opted not to report the issue to Apple due to past experiences with delayed responses. The vulnerability affects users of Private Relay and the OnionBrowser app, but not the official Tor Browser. Apple acknowledged the severity of the issue but has not provided a timeline for a fix. The researchers have developed a private browser called Psylo, which mitigates the IP leak problem. 6 sources 65

Extracted Entities

Apple iCloud Private Relay WebKit Flaws Leak Users’ Real IP Addresses

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (2)