A newly disclosed flaw in Apple’s Private Relay feature can expose a user’s real IP address, undermining the privacy protection the iCloud+ feature is designed to provide. Security researchers Tommy Mysk and Talal Haj Bakry disclosed the issue this week.
Private Relay is meant to mask a user’s IP address from the websites they visit by routing Safari traffic through two separate relays, similar in spirit to a VPN but limited to Apple’s own browser. The researchers found that any website supporting, or merely pretending to support, passkey logins can see a user’s real IP address even while Private Relay is switched on.
The root cause lies in how passkeys work. Passkeys operate outside the browser itself, relying on Apple’s WebAuthn framework at the operating system level. When a website requests a passkey credential, that request bypasses Safari’s network stack entirely, which means it is not covered by Private Relay’s protections.
The researchers identified two additional WebKit features carrying similar risks. DNS prefetching, introduced in iOS 26, can reveal a user’s real DNS servers, while WebTransport, added in iOS 26.4, can also leak IP address information. All three issues stem from browser-level features that operate outside the scope of what Private Relay was built to shield.
Private Relay is only available to iCloud+ subscribers and only functions while browsing in Safari, unlike a full VPN, which protects a device’s IP address at the system level regardless of which app or browser is being used. That narrower scope is part of what makes the passkey and WebKit-related leaks possible.
The researchers have published a website that lets users test their own devices to see whether their real IP address is leaking despite having Private Relay enabled. Apple has not yet issued a public statement confirming a fix or timeline for one.
The discovery adds to a growing list of privacy and security concerns around browser-level identity and networking features as passkeys become more widely adopted across the web as a password alternative.
Follow iNews Zoombangla On Google
Open the Google follow page and tap the checkmark option to receive more updates from iNews Zoombangla in your Google news feed.
