The promise of iCloud Private Relay was clear: to hide your real IP address while browsing with Safari so websites couldn't track you. However, recent research has revealed that this protection isn't always effective. A group of security experts has found several ways your IP address can be revealed , even with the service enabled. The problem is more serious than it seems, because it affects all browsers on iOS and macOS, and has already generated significant concern among users.
Researchers Tommy Mysk and Talal Haj Bakry, known for their privacy analyses, have published a report detailing three flaws in WebKit , the engine used by all browsers on iOS. These flaws allow a malicious website to obtain your real IP address without your knowledge, completely bypassing the Private Relay privacy tunnel. The news has gone viral in recent hours, and Apple has already acknowledged that it is investigating the issue, although it has not provided a timeline for a fix.
The origin of the problem: passkeys and other escape routes
The most serious and relevant flaw for the average user concerns passkeys, the increasingly popular passwordless authentication system . When a website requests a passkey, the request isn't handled within the Safari browser; instead, the device's operating system processes it directly at the system level. This process, which uses the WebAuthn standard, runs outside the privacy tunnel created by Private Relay, meaning the requesting website can easily see the device's real IP address.
The issue is particularly sensitive because, as the researchers point out, any website can simulate support for passkeys to force this request and obtain the visitor's IP address. No user interaction is required, making this a silent backdoor for tracking and identification. Furthermore, the researchers have documented two additional flaws in WebKit that exacerbate the situation: DNS prefetching, which filters queries to the Domain Name System, and WebTransport, a direct connection protocol that also bypasses the proxy.
Mysk and Haj Bakry have made available a test website, leaks.psylo.app, where anyone can check if their IP address is being leaked despite having Private Relay enabled. Tests conducted by 404 Media journalists on this site confirmed that the tool displayed the real IP address of a user who, in theory, was protected by Apple's service.
Reach in the iOS ecosystem and beyond
One of the peculiarities of this problem is that it doesn't only affect Safari. Due to App Store policies, all browsers available on iOS , such as Chrome, Firefox, and Brave, are required to use the WebKit engine. This means the vulnerability extends to virtually every browser on the system, including privacy-focused options like Onion Browser, a browser that connects to the Tor network. Researchers have confirmed that this browser also suffers from IP leaks and have already contacted its developers to find solutions.
This situation has reignited the debate about the nature of iCloud Private Relay. Unlike a traditional VPN, which protects all network traffic on the device at the system level, Private Relay only acts on traffic passing through Safari. This often-overlooked difference is at the root of the current problem. Experts insist that a service like this should not be considered a substitute for a full-fledged VPN , as its scope is much more limited than many users believe.
In Europe and Spain, the situation is particularly relevant. Privacy is a fundamental right protected by the General Data Protection Regulation (GDPR), and the Spanish Data Protection Agency (AEPD) is one of the bodies that most actively monitors compliance with these regulations. A failure of this nature in a service marketed precisely as a bastion of privacy could have regulatory implications , especially if it is demonstrated that the functionality does not offer the promised level of protection.
Apple's response and recommendations
Apple has confirmed to 404 Media that it is investigating the researchers' report, though it has not provided a specific date for a fix. On the security reporting portal used by the researchers, the status of the issue indicates that a fix is ​​planned for fall 2026. However, past experience with a similar flaw in the Hide My Email service, which also exposed user data and took more than a year to resolve, raises doubts about the speed of the response.
Meanwhile, the only way to completely protect your IP address on iOS is to use a system-level VPN . Services like ProtonVPN, Mullvad, or WireGuard, for example, can protect all device traffic, including requests originating outside the browser, such as those related to passkeys. Researchers confirm that a traditional VPN protects all device traffic, including passkey requests that escape the privacy tunnel.
The security community has already focused its attention on this issue, and rightly so. The leak of real IP addresses could allow advertising networks and tracking services to link a user's identity to their browsing activity, completely undermining the purpose of Private Relay. Although the vulnerability hasn't been exploited on a massive scale so far, the mere fact that a demo website exists and that international media outlets have verified the problem underscores the seriousness of the situation.
In conclusion, it's important to remember that this incident doesn't completely invalidate the usefulness of iCloud Private Relay. The rest of your browsing through Safari remains protected by the double relay system, which prevents Apple and websites from correlating your IP address with your activity. However, the existence of these loopholes, particularly those related to passkeys, demonstrates that digital privacy is a constant battleground where seemingly robust solutions can have blind spots. Users should be aware of these limitations and, if their perceived threat is high, consider using complementary tools like a VPN to ensure truly comprehensive protection. Trust in privacy promises should be based on a real understanding of how these technologies work and what their limitations are.