Researchers Say Apple Private Relay Can Leak Users’ Real IP Addresses

Security researchers have disclosed a set of flaws that they say can expose the real IP addresses of users browsing with Apple’s Private Relay, an iCloud+ feature designed to hide a user’s identity while using Safari.

The findings were published on Tuesday alongside a website that allows users to test whether their real IP address is exposed despite having Private Relay enabled. 404 Media first reported the issue.

Researchers Talal Haj Bakry and Tommy Mysk said the problem stems from three features within Apple’s WebKit browser engine, which powers Safari and all browsers on iOS. Because Private Relay only protects Safari traffic and does not operate at the operating system level like a traditional virtual private network (VPN), the reported flaws could reveal a user’s actual IP address under certain conditions.

Private Relay differs from a VPN

Apple’s Private Relay is available only to iCloud+ subscribers and is designed to mask a user’s IP address while browsing the web with Safari. Unlike a VPN, however, it does not encrypt or route all internet traffic from the device, limiting its protection to Safari browsing sessions.

The researchers said those design limitations, combined with the WebKit-related issues they identified, make it possible to bypass the privacy feature and determine a user’s real IP address.

Researchers chose not to notify Apple

Mysk said on X that he and his colleague decided not to report the findings to Apple before publishing them, citing previous experiences that they said involved lengthy delays, inconsistent communication and disagreements over the severity of reported issues.

Apple did not immediately respond to requests for comment following publication of the research.

Psylo browser includes mitigations

Bakry and Mysk are also the developers of Psylo, a privacy-focused browser. They said the browser now includes protections designed to prevent users’ IP addresses from leaking through the issues they identified, offering an alternative approach for users seeking stronger privacy while browsing.