# Apple faces legal action over iCloud Private Relay IP leaks

> Live situation record from CLSTR: https://clstr.news/situations/apple-icloud-private-relay-security-vulnerabilities
> Updated: 2026-08-14T14:06:09.000Z. Sources: 29. Developments: 4.

Security researchers Talal Haj Bakry and Tommy Mysk identified vulnerabilities in Apple’s iCloud Private Relay that allow websites to bypass the service’s proxy to reveal a user’s actual IP address and DNS queries. The flaws involve the WebKit engine, specifically through DNS prefetching, WebTransport, and passkey-based authentication. Because Apple requires all iOS browsers to use WebKit, the issue affects Safari and third-party browsers such as Tor and Psylo.

Apple has stated that Private Relay is not a full-device VPN and only masks traffic within Safari. The company noted that passkey-based authentication requests handled by the operating system’s credential service bypass the proxy, exposing the real IP address to the destination server. Apple has indicated it is investigating the matter, with a fix expected in the fall of 2026.

Following these revelations, Apple is facing allegations of fraud and a class-action lawsuit. The Clarkson Law Firm filed the suit in the U.S. District Court for the Northern District of California, alleging fraud and deceptive advertising. The legal action claims that iCloud+ subscribers paid for privacy protections that failed to function as advertised. Legal experts have suggested that Apple may have been aware of these flaws for some time, noting that the company only issued patches after the vulnerabilities were publicly exposed. This development follows a previous controversy regarding the ‘Hide My Email’ feature, which also reportedly leaked actual email addresses despite being a paid privacy service.

## Timeline

### 2026-08-14: Apple faces lawsuit over iCloud Private Relay privacy flaws

Apple faces a class action lawsuit following research showing iCloud Private Relay can leak users' real IP addresses, potentially violating privacy promises made to iCloud+ subscribers.

2 sources. https://clstr.news/cluster/apple-faces-lawsuit-over-icloud-private-relay-privacy-flaws

### 2026-08-11: Apple faces legal action over iCloud Private Relay IP leaks

Apple faces legal action and fraud allegations after researchers discovered that iCloud Private Relay can leak users' real IP addresses due to vulnerabilities in the WebKit engine.

4 sources. https://clstr.news/cluster/apple-faces-fraud-lawsuit-over-icloud-private-relay-privacy-claims

### 2026-08-07: Apple iCloud Private Relay vulnerability exposes real IP addresses

Security researchers found that Apple's iCloud Private Relay can leak users' real IP addresses due to vulnerabilities in the WebKit engine, affecting Safari and other iOS browsers.

2 sources. https://clstr.news/cluster/apple-icloud-private-relay-vulnerability-exposes-real-ip-addresses

### 2026-08-05: Apple iCloud Private Relay leaks real IP addresses via WebKit flaws

Researchers found three WebKit bugs that let sites bypass Apple’s iCloud Private Relay, exposing real IP addresses on iOS/macOS browsers; Apple is investigating with a fix slated for fall 2026.

24 sources. https://clstr.news/cluster/apples-webkit-lets-iphone-browsers-bypass-proxies-via-dns-webauthn-and-webtransport

---
Cite as: Apple faces legal action over iCloud Private Relay IP leaks. CLSTR, https://clstr.news/situations/apple-icloud-private-relay-security-vulnerabilities