Security researchers revealed on Tuesday that Apple’s iCloud+ Private Relay feature contains critical WebKit vulnerabilities that expose users’ real IP addresses while browsing on Safari.
How the Apple Private Relay Leak Was Discovered
Cybersecurity experts Talal Haj Bakry and Tommy Mysk detailed the vulnerability in a blog post published on Tuesday. To demonstrate the flaw, the researchers set up a website allowing iOS and macOS users to test if their real IP address is being exposed despite having Private Relay active. TechCrunch independently verified the exploit, confirming that the test site successfully bypassed the privacy feature to reveal their actual IP address. The security issue was first reported by 404 Media.
WebKit Flaws Expose iOS and Safari Users
According to Bakry and Mysk, the root of the privacy leak lies within three distinct features in WebKit, Apple’s proprietary web browser engine. Because WebKit powers every single web browser running on iOS, this flaw has widespread implications for mobile users. While Private Relay is marketed as a key privacy benefit for iCloud+ subscribers, it operates differently from a traditional Virtual Private Network (VPN). Unlike a system-wide VPN that encrypts all network traffic, Private Relay only secures data transmitted through the Safari browser.
Why Researchers Bypassed Apple’s Bug Bounty Scheme
In an unexpected move, Mysk and Bakry chose not to report this vulnerability directly to Apple. Addressing the decision, Mysk wrote in a post on X that their past experiences with the tech giant discouraged them from doing so. He noted that reporting issues to Apple typically results in months of communication delays, inconsistent updates, and occasionally, outright denials regarding the severity of the security impact.
Apple has not yet responded to requests for comment regarding the WebKit vulnerabilities. Meanwhile, the researchers have implemented mitigations in their own privacy-focused browser, Psylo, to prevent IP address leaks for their users.