How Apple's Private Relay Could Compromise Privacy
Security researchers Talal Haj Bakr and Tommy Mysk have uncovered a flaw in Apple's Private Relay feature: instead of always hiding a Safari user's IP address, the browser may actually give it away because of a bug in the WebKit engine. The leak can occur when someone signs into a website with a passkey, a passwordless login method. What makes the issue especially dangerous is that the passkey authentication confirmation request does not travel through the browser, so users and security tools may not notice it happening.
Security and Privacy Impact
Private Relay is part of an iCloud+ subscription and only protects traffic inside Safari; it is not a full-device VPN. Given that WebKit is the underlying engine for every iPhone and iPad browser, the problem could affect not just Safari but also other iOS browsers, including OnionBrowser and Psylo. The researchers have handed their findings and potential remediation steps to the OnionBrowser developers and the Tor Project, while Apple told 404 Media that it is reviewing the report.
This issue echoes a prior case: in mid-2025, a comparable flaw surfaced in iCloud's Hide My Email feature, and Apple only fixed it after roughly a year. If that experience is any guide, a Private Relay patch could be slow to arrive.
For context, Private Relay is an iCloud+ feature designed to mask the IP address of Safari users. The latest discovery underscores how even privacy-focused tools can contain hidden weaknesses. Until Apple rolls out a fix, users who depend on Private Relay to protect their online activity should stay cautious. At the same time, Apple now has a chance to apply lessons from past incidents and make its services more resilient against such vulnerabilities.
This recent revelation about Apple's Private Relay feature raises important questions about the company's commitment to user privacy. Similar concerns have emerged in the past, such as the delay in launching smart glasses due to privacy risks following scandals involving Meta. To understand how these incidents impact Apple's product development and user trust, read more about the privacy challenges affecting Apple's innovations.