{"id":925173,"date":"2026-08-06T06:12:05","date_gmt":"2026-08-06T11:12:05","guid":{"rendered":"https:\/\/newsycanuse.com\/index.php\/2026\/08\/06\/apples-private-relay-isnt-so-private-after-all-can-leak-your-ip-address\/"},"modified":"2026-08-06T06:12:05","modified_gmt":"2026-08-06T11:12:05","slug":"apples-private-relay-isnt-so-private-after-all-can-leak-your-ip-address","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2026\/08\/06\/apples-private-relay-isnt-so-private-after-all-can-leak-your-ip-address\/","title":{"rendered":"Apple\u2019s Private Relay Isn\u2019t So Private After All, Can Leak Your IP Address"},"content":{"rendered":"
\n

Apple\u2019s iCloud Private Relay feature is designed to obscure your web traffic so sites like advertisers, unscrupulous governments or malicious attackers can\u2019t trace that traffic back to you. But it turns out the mechanism isn\u2019t actually as private as Apple says.<\/p>\n

As reported by\u00a0404 Media<\/a>, security researchers at software company Mysk discovered that even with iCloud Private Relay active, the IP address of a device or home network can be transmitted, which could be used to reveal a person\u2019s identity or location.<\/p>\n

iCloud Private Relay<\/a>\u00a0is a feature for paid customers of Apple\u2019s iCloud Plus service. It routes web traffic through proxy servers, obscuring your IP address and the website address you\u2019re visiting, so neither the site nor Apple can see that information.<\/p>\n

It\u2019s also a feature that runs within Apple\u2019s WebKit framework, which includes the Safari browser and other apps and services that use WebKit to access websites. It\u2019s specifically\u00a0not a VPN<\/a>\u00a0(Virtual Private Network), which encrypts all internet traffic and runs it through a proxy server.<\/p>\n

The researchers,\u00a0Talal Hak Bakry and Tommy Mysk, set up a\u00a0website<\/a>\u00a0that lets you check whethe<\/span>r your connection is vulnerable. When I tested it using an iPhone 17 Pro and a MacBook Pro with iCloud Private Relay enabled, it correctly identified the IP address of my home internet router.<\/p>\n

The information in the red box shows the IP address of my home router.Screenshot by Jeff Carlson\/CNET<\/span><\/figcaption><\/figure>\n

In a\u00a0post on X<\/a>, the researchers noted that they chose to make the vulnerability public rather than report it to Apple first.<\/p>\n

\u201cUnfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue\u2019s impact entirely,\u201d the researchers wrote. \u201cWe weren\u2019t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of [Mysk\u2019s browser] Psylo and iOS Tor browsers while saying or doing nothing.\u201d<\/p>\n

An Apple representative didn\u2019t immediately respond to a request for comment.<\/p>\n

How iCloud Private Relay is being bypassed<\/h2>\n

One problem is related to passkeys<\/a>, the method of signing into sites that\u2019s more secure and user-friendly than usernames and passwords. WebKit bypasses the Private Relay proxy and sends requested information directly from the device.<\/p>\n

\u201cBecause the fetch is issued by the operating system\u2019s credential service rather than by Safari, it never enters Private Relay\u2019s proxied path,\u201d the researchers wrote on the\u00a0Mysk blog<\/a>. \u201cThe destination server sees the device\u2019s real IP address either way.\u201d<\/p>\n

There are two other paths that can reveal your IP address even with iCloud Private Relay enabled.<\/p>\n

DNS prefetching is a way for websites to request data before it\u2019s needed to speed up the connection. That happens separate from the relay mechanism, so the data is passed directly from your network to the website. However, a site must include the code\u00a0in its HTML to trigger it.<\/p>\n

The third vulnerability is with a low-latency method called WebTransport where WebKit opens a direct connection that bypasses the private relay and sends the user\u2019s real IP address.<\/p>\n

Apple\u2019s security also took a hit recently when a bug in Apple\u2019s iCloud\u00a0Hide My Email<\/a>\u00a0feature seemed to expose people\u2019s real email addresses. It, too, is a paid feature of iCloud Plus and is now the focus of a\u00a0lawsuit<\/a>\u00a0accusing Apple of false advertising, fraud and breach of contract.<\/p>\n

\n
\n
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Jeff\t\t\t\t\t\t<\/picture>\n\t\t\t\t\t<\/div>\n
\n

Jeff Carlson<\/span>\n\t\t\t\t\t\t<\/p>\n


\n\t\t\t\t\t\t\tSenior Writer\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/p>\n<\/div><\/div>\n


\n\t\t\t\t\t\t\t\t\t\t\tJeff Carlson writes about mobile technology at CNET, from cellular phone plans to devices and emerging technology.<\/span>
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\tSee full bio\t\t\t\t\t<\/a>
\n\t\t\t\t<\/span>\n\t\t\t<\/p>\n<\/div>\n<\/div>\n

Read More<\/a>
\n Jeff Carlson<\/p>\n","protected":false},"excerpt":{"rendered":"

Apple\u2019s iCloud Private Relay feature is designed to obscure your web traffic so sites like advertisers, unscrupulous governments or malicious attackers can\u2019t trace that traffic back to you. But it turns out the mechanism isn\u2019t actually as private as Apple says. As reported by\u00a0404 Media, security researchers at software company Mysk discovered that even with<\/p>\n","protected":false},"author":1,"featured_media":925174,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[270,255,46],"tags":[],"class_list":["post-925173","post","type-post","status-publish","format-standard","has-post-thumbnail","category-apples","category-private","category-technology"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/925173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=925173"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/925173\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/925174"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=925173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=925173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=925173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}