Apple iCloud Private Relay vulnerability exposes real IP addresses

Security researchers Talal Haj Bakry and Tommy Mysk have identified vulnerabilities in Apple's iCloud Private Relay that can expose a user's real IP address. The issue stems from WebKit, the engine used by iOS browsers, which can allow network traffic to bypass the service's proxy settings.

The researchers documented three specific vulnerabilities involving DNS preloading, WebTransport, and passkeys. The most significant flaw relates to passkeys; when a user authenticates using this method, WebKit may request the operating system to handle the request directly through the standard connection rather than the protected Private Relay route. This process occurs without user notification, potentially leaking the real IP address to the destination server.

Because Apple's App Store policies require all iOS browsers to use WebKit, the vulnerability extends beyond Safari to include other iOS browsers like Tor and Psylo. Apple has stated it is currently investigating the report.