PSA: Apple’s Private Relay can leak your real IP address
Researchers have identified vulnerabilities in Apple's Private Relay, a Safari-exclusive privacy feature for iCloud+ subscribers designed to mask users' IP addresses. The flaws stem from three specific issues within Apple's WebKit browser engine, allowing attackers to circumvent the protection and expose users' real IP addresses despite the feature being active.
The security researchers chose not to report the issue directly to Apple, citing previous negative experiences with the company's response to vulnerability disclosures. Apple has not publicly addressed the matter, while the researchers have published a testing website for users to check if their IP leaks and developed their own private browser with mitigations against this type of vulnerability.
In short
- Apple's Private Relay can be circumvented to reveal hidden IP addresses due to three flaws in the Safari engine WebKit
- Researchers published findings and a testing tool without reporting to Apple first, citing poor past communication
- The vulnerability affects Safari only and exposes a gap in the privacy protection system
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The researchers had documented negative prior experiences with Apple's vulnerability disclosure process, making traditional responsible disclosure problematic. Public disclosure creates immediate pressure for patching whilst allowing affected users to test whether they're vulnerable through the provided testing site, and sophisticated attackers often discover such flaws independently anyway. Transparency about real weaknesses in privacy features users rely upon enables them to make informed decisions about their security.
The case against
Even where vendors have historically poor response records, completely bypassing private notification removes the structured timeframe that allows vendors to patch before vulnerabilities become widely weaponised. Coordinated disclosure frameworks exist precisely to pressure slow vendors without abandoning vendor notification entirely, providing leverage whilst limiting the exposure window. The researchers could have invoked established responsible disclosure processes to address their legitimate concerns about Apple's past slowness without unilateral public release.
Explained simply
Apple Private Relay is an optional feature for people who pay for iCloud+. When they browse with Safari, it sends internet traffic through two relays, which are intended to hide the user’s IP address—the number that can help identify their device and approximate location—from websites.
The feature relies on WebKit, Apple’s browser engine, which handles how web pages load. Security researchers say weaknesses in that engine can let an attacker get around the protection and reveal a user’s real IP address, even while Private Relay is on.
The researchers say they did not report the flaws to Apple directly, referring to earlier experiences with the company’s handling of disclosures. Apple has not publicly commented on the reported issues, leaving users and security experts without the company’s account of their scope or response.