Updated

Updated · Fox News · Aug 16

Researchers Find 3 WebKit Paths That Bypass iCloud Private Relay, Exposing Real IPs

Updated

Updated · Fox News · Aug 16

Researchers Find 3 WebKit Paths That Bypass iCloud Private Relay, Exposing Real IPs

Q: If Apple's Private Relay leaks your IP without user interaction, is browser-level privacy just an illusion?

No. The leak shows browser-level privacy is limited, not imaginary. Apple’s iCloud Private Relay still raises the privacy bar by hiding Safari traffic behind a two-hop relay in normal use. What the researchers found is that some WebKit features can fall outside that protected path. In those cases, DNS prefetching can reveal network metadata, while WebAuthn-related requests and WebTransport can expose a device’s real IP address without user interaction. That is a real privacy failure, but it does not mean Private Relay does nothing. The deeper lesson is that browser-level privacy tools are only as strong as the browser engine’s ability to capture every outbound request. Here, WebKit appears not to cover certain auxiliary or system-triggered connections. That is why the same issue affects Safari and other iOS and macOS apps that rely on WebKit’s proxy configuration. It is also why a system-wide VPN is in a different category: it tunnels traffic at the operating-system level, below the browser, so these bypasses do not escape it. The findings also do not mean passkeys are broken. Researchers say the credentials remain secure; the leak is the surrounding network request, not account takeover. For users, the practical answer is not to abandon Private Relay, but to understand its scope. Keep it enabled, update Apple devices quickly, and use a full-device VPN when hiding your IP address is critical. Private Relay is useful privacy protection, but it is not airtight anonymity.

3 articles · Updated · Fox News · Aug 16

Talal Haj Bakry and Tommy Mysk identified three WebKit mechanisms that can route some Safari traffic outside iCloud Private Relay, potentially exposing users’ real IP addresses or DNS details.
DNS prefetching can send lookups over a device’s normal DNS connection, while WebAuthn domain-verification requests and WebTransport sessions can connect directly to servers instead of Apple’s relay path.
Two of the three paths can reveal a user’s actual IP address; the DNS issue has existed since iOS 26.0, and WebTransport became publicly available on iOS 26.4.
The findings matter most for iCloud+ users relying on Safari or other WebKit-based proxy browsers for IP privacy, while system-level VPNs are not affected by these specific leaks.
Apple had not commented by publication time; researchers and browser developer Psylo say mitigations include keeping devices updated and, when IP secrecy is critical, using a full-device VPN.