Researchers have identified vulnerabilities in Apple's Private Relay, a Safari-exclusive privacy feature for iCloud+ subscribers designed to mask users' IP addresses. The flaws stem from three specific issues within Apple's WebKit browser engine, allowing attackers to circumvent the protection and expose users' real IP addresses despite the feature being active.

The security researchers chose not to report the issue directly to Apple, citing previous negative experiences with the company's response to vulnerability disclosures. Apple has not publicly addressed the matter, while the researchers have published a testing website for users to check if their IP leaks and developed their own private browser with mitigations against this type of vulnerability.