Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.
Researchers Talal Haj Bakry and Tommy Mysk found that three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass configured proxies and send traffic directly from the device. This leaks the user's real IP address in Safari and all WebKit-based iOS browsers and undermines iCloud Private Relay's dual-hop privacy design. Any website can trigger the leak via WebAuthn without user interaction or passkey use; a proof-of-concept site, leaks.psylo.app, demonstrates the issue. Apple investigated and patched the leaks in iOS 26.6.1 and macOS 26.6.2.
- DNS prefetching resolves hostnames outside the proxy, exposing the device's network
- WebAuthn Related Origin Requests make the OS credential service fetch validation files directly
- WebTransport opens direct HTTP/3 connections that bypass proxy configuration
- PoC site leaks.psylo.app lets users test for leaks; VPNs mitigate
- A WebRTC-based iCloud Private Relay leak was reported by FingerprintJS in 2021
- Organizations
- The Hacker News404 Media
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 06, 2026 Vulnerability / Network Security Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.