[REVISION HISTORY]

Apple faces legal action over iCloud Private Relay IP leaks

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-08-14 13:53 UTC → 2026-08-16 03:32 UTC · added ~~removed~~

Security researchers Talal Haj Bakry and Tommy Mysk identified vulnerabilities in Apple’s iCloud Private Relay that allow websites to bypass the service’s proxy to reveal a user’s actual IP address and DNS queries. The flaws involve the WebKit engine, specifically through DNS prefetching, WebTransport, and passkey-based authentication. Because Apple requires all iOS browsers to use WebKit, the issue affects Safari and third-party browsers such as Tor and Psylo. Apple has stated that Private Relay is not a full-device VPN and only masks traffic within Safari. The company noted that passkey-based authentication requests handled by the operating system’s credential service bypass the proxy, exposing the real IP address to the destination server. Apple has indicated it is investigating the matter, with a fix expected in the fall of 2026. Following these revelations, Apple is facing allegations of fraud and a class-action lawsuit. The Clarkson Law Firm filed the suit in the U.S. District Court for the Northern District of California, alleging fraud and deceptive advertising. The legal action ~~follows~~ claims that ~~the~~ iCloud+ ~~feature fails~~ subscribers paid for privacy protections that failed to ~~protect user IP addresses~~ function as advertised. Legal experts have suggested that Apple may have been aware of these flaws for some time, noting that the company only issued patches after the vulnerabilities were publicly exposed. This development follows a previous controversy regarding the ‘Hide My Email’ feature, which also reportedly leaked actual email addresses despite being a paid privacy service.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.