Login
Apple’s iCloud Private Relay can leak your real IP address through passkey logins, researchers warn
Apple’s iCloud Private Relay is designed to hide users’ IP addresses from websites and even from Apple itself while browsing in Safari. But according to security researchers Talal Haj Bakry and Tommy Mysk, the feature does not always work as intended because of issues in Apple’s WebKit browser engine.
The problem centers on passkeys, the password-free authentication method that is becoming more widely used. When a user authenticates with a passkey, the request is handled outside the browser itself. Private Relay only protects traffic within Safari (as an iCloud+ feature) and does not function like a full-device VPN. As a result, the authentication request can expose the user’s real IP address to the website or service.
Because the vulnerability sits in WebKit, the engine that powers every browser on iOS, the IP leak is not limited to Safari. Privacy-focused browsers such as OnionBrowser and the researchers’ own Psylo browser can also reveal a user’s IP when passkeys are used.
Re: Responsible Disclosure
We found ourselves in a bit of a dilemma with these DNS and IP leaks in WebKit and how to handle them responsibly.
We first became aware of a DNS leak in Psylo in late June 2026 after a user reported it. During our investigation, we found two… https://t.co/5kFu0jtUsJ
— Mysk
(@mysk_co) August 5, 2026
The researchers have already notified OnionBrowser and the Tor Project of their findings and suggested fixes. Apple has told 404 Media that it is investigating the report. However, Bakry and Mysk noted that Apple’s response times for similar privacy issues can be lengthy; a previously reported problem with the Hide My Email feature that allowed real email addresses to leak behind aliases was not fully fixed for about a year after it was disclosed.
MacDailyNews Take: Until a fix arrives, users who rely on Private Relay for anonymity should be aware that logging in with passkeys on iOS may still reveal their IP address.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
The post Apple’s iCloud Private Relay can leak your real IP address through passkey logins, researchers warn appeared first on MacDailyNews.
