Apple’s iCloud Private Relay, a feature designed to enhance user privacy by concealing IP addresses during Safari browsing, has been found to potentially leak users’ real IP addresses due to specific vulnerabilities.
Security researchers Talal Haj Bakry and Tommy Mysk identified issues within Apple’s WebKit browser engine, which is integral to all iOS browsers. These flaws can allow websites to bypass Private Relay’s protections and access a user’s actual IP address. To demonstrate this vulnerability, the researchers created a website that reveals a visitor’s real IP address, even when Private Relay is active. Testing confirmed that the site could successfully expose the true IP address of users relying on Private Relay.
Private Relay, available exclusively to iCloud+ subscribers, is not a comprehensive VPN solution. Unlike traditional VPNs that protect IP addresses at the system level, Private Relay operates solely within the Safari browser. This limitation means that other applications and browsers on the device do not benefit from its privacy features.
The researchers chose not to report the issue directly to Apple, citing previous experiences of prolonged response times and inconsistent communication. As a result, they have implemented mitigations in their own private browser, Psylo, to prevent similar IP address leaks.
Apple has yet to respond to these findings. Users concerned about their privacy should be aware of these limitations and consider additional measures to safeguard their online activities.
This discovery underscores the importance of continuous scrutiny and improvement of privacy tools. While features like Private Relay represent significant steps toward enhanced user privacy, they are not infallible. Users should remain vigilant and consider using comprehensive privacy solutions, such as full-system VPNs, to ensure their online anonymity.
