Apple’s iCloud Private Relay, a feature designed to enhance user privacy by masking IP addresses during Safari browsing, has been found to potentially expose users’ real IP addresses under certain conditions. Security researchers have identified that when websites utilize or simulate the use of passkeys, the actual IP address of the user can be inadvertently revealed.
iCloud Private Relay operates by routing user requests through two separate internet relays, effectively concealing the user’s IP address and DNS information from websites. This service is included with paid iCloud+ plans and aims to provide a more private browsing experience. However, it is important to note that Private Relay is not a comprehensive VPN solution and does not mask all traffic from a device.
The vulnerability arises from the interaction between Private Relay and the WebAuthn standard, which is employed for passkey authentication. WebAuthn stores a private key on the user’s device, independent of the Safari browser. When a website initiates a WebAuthn request, the operating system’s credential service processes this request directly, bypassing Safari and, consequently, the protective measures of Private Relay. As a result, the user’s real IP address is exposed to the destination server.
Further complicating the issue, an attacker could exploit this vulnerability by setting up a website that utilizes WebAuthn. The process can occur without any visible passkey prompt or user interaction, making it difficult for users to detect that their IP address has been accessed.
In addition to the WebAuthn-related exposure, researchers have identified two other WebKit features that can leak IP addresses and DNS data. DNS prefetching, introduced in iOS 26, reveals a user’s real DNS servers, while WebTransport, added in iOS 26.4, can disclose an IP address.
Apple has acknowledged the findings and is currently investigating the reported vulnerabilities. In the interim, users seeking enhanced privacy protection may consider using a traditional VPN service, which offers more comprehensive coverage by encrypting all internet traffic from the device.
This development underscores the complexities involved in implementing privacy features within web browsers and operating systems. While iCloud Private Relay represents a significant step towards enhancing user privacy, the identified vulnerabilities highlight the need for continuous evaluation and improvement of such services. Users should remain vigilant and consider additional privacy tools to safeguard their online activities.
