Apple faces legal action over iCloud Private Relay IP leaks

Apple is facing allegations of fraud and a class-action lawsuit following revelations that its iCloud+ feature, iCloud Private Relay, fails to protect users' IP addresses as advertised. Security researchers Tommy Mysk and Talal Haj Bakry identified several vulnerabilities within WebKit, the engine powering all iOS browsers, which allow malicious websites to bypass the privacy tunnel and access a user's real IP address.

The flaws reportedly involve passkey authentication, DNS preloading, and the WebTransport protocol. Because passkey requests are handled by the operating system rather than the Safari browser, they can bypass the Private Relay proxy entirely.

Legal experts suggest that Apple may have been aware of these flaws for some time, as the company only issued patches after the vulnerabilities were publicly exposed. This follows a previous controversy regarding the ‘Hide My Email’ feature, which also reportedly leaked actual email addresses despite being a paid privacy service.