Cybersecurity researchers **Talal Haj Bakry** and **Tommy Mysk** have disclosed a significant security issue affecting **Apple**'s **iCloud Private Relay** tool. This vulnerability can potentially expose a user's real IP address, undermining the service's core privacy promise. ### Understanding iCloud Private Relay Introduced with **iOS 15**, **iCloud Private Relay** is designed to enhance user privacy by routing **Safari** web traffic through a dual-hop architecture. This setup ensures that neither **Apple** nor any single third-party can simultaneously know a user's origin IP address and their browsing destination, offering a layer of anonymity for **iCloud+** subscribers. ### The Root of the Problem: WebKit Vulnerabilities The researchers identified the problem within three specific features of **Apple**'s **WebKit**: DNS prefetching, **WebAuthn** Related Origin Requests, and **WebTransport**. **WebKit** is the foundational web browser engine for **Safari** and all third-party browsers on **iOS** and **iPadOS**, including **Google Chrome**, **Microsoft Edge**, **Mozilla Firefox**, and **Brave**. According to **Bakry** and **Mysk**, these three features "bypass the configured proxy and send traffic directly from the device, which exposes the user's real network." This direct communication path circumvents the privacy protections offered by **iCloud Private Relay**. ### Specific Leak Mechanisms The issues affect **macOS** as well as any other **WebKit**-based browser relying on **WebKit**'s proxy configuration APIs. In each case, the device's actual IP address is leaked through: * **DNS prefetching**: This resolves hostnames via the device's standard DNS path instead of the browser's designated proxy. * **WebAuthn Related Origin Requests**: These prompt the operating system's credential service to fetch a validation file directly from the device. * **WebTransport**: This establishes a direct **HTTP/3** connection, bypassing any configured proxy. ### WebAuthn and IP Exposure Notably, the **WebAuthn** vulnerability poses a particular risk. Since **WebAuthn** enables users to log into websites using passkeys, any website supporting this standard can potentially view a user's real IP address, even with **iCloud Private Relay** enabled. "Any website can configure **WebAuthn** (the API used for passkeys) in a way that causes **WebKit** to reveal the browser's real IP address, bypassing both proxy configurations and **iCloud Private Relay** in **Safari**," **Mysk** explained. He added that exploiting this vulnerability does not require user interaction or the actual use of passkeys; the website merely needs to be configured to deliberately exploit it. ### Proof-of-Concept and Mitigation A proof-of-concept (PoC) website, `leaks.psylo[.]app`, has been made available for users to test if their real IP address is being leaked while **Private Relay** is active. The site distinguishes between "HTTPS Traffic" (regular network traffic) and "Possible IP leaks," which illustrate how the device's real IP can bypass the proxy. **Mysk** clarified that not all browsers are affected (e.g., desktop **Chrome** is not), and the leaks are mitigated when a user is connected to a VPN. ### Apple's Response and Past Issues **Apple** has not yet issued a public statement but has reportedly informed 404 Media that it is investigating the researchers' report. This is not the first time **iCloud Private Relay** has faced scrutiny. Shortly after its 2021 launch, **FingerprintJS** identified a **WebRTC**-based mechanism that also leaked client IP addresses. More recently, **Apple** addressed a vulnerability in its **Hide My Email** service that could unmask users' real email addresses under specific conditions, further highlighting ongoing challenges in maintaining privacy guarantees.