It has been claimed that the Private Relay feature offered by Apple to iCloud+ subscribers can reveal users’ real IP address to websites and online services in some usage scenarios. According to the findings shared by security researchers Talal Haj Bakry and Tommy Mysk, the problem is caused by the WebKit infrastructure used by Safari. Under normal circumstances, Private Relay aims to protect user privacy by hiding the IP address while surfing the Internet via Safari. However, researchers state that this protection may be disabled in certain authentication processes. Apple confirmed that it was evaluating the report on the issue.
The main scenario that researchers draw attention to is related to the passkey-based login system, which has become increasingly common lately. In passkey technology, which was developed as a password-free and more secure authentication method, the login request is not always made directly through the browser. For this reason, Private Relay, which works with Safari, cannot act like a traditional VPN that protects all network traffic across the device. As a result, when the user logs into a website with a passkey via Safari, there is a possibility that the real IP address will be revealed during the authentication request.
All WebKit-based iOS browsers may be affected
According to researchers, the problem is not limited to Safari. Since all browsers on Apple’s iOS platform are required to use the WebKit engine, the same behavior can be seen in different browsers. This situation may also affect applications such as OnionBrowser, which was developed for privacy purposes, and Psylo, developed by researchers. In other words, even if the user prefers a different browser, the real IP address can be seen by the relevant website or service during the passkey login process.
In addition, the researchers announced that they shared their findings with OnionBrowser developers and the Tor Project, which provides the anonymity network used by the browser. The aim is to evaluate possible solutions together and reduce the impact of similar privacy problems. Statements on the subject were published on the social media platform X.
In its statement to 404 Media, Apple confirmed that it was reviewing the report submitted by security researchers. Despite this, it is stated that the process may not take a short time to resolve similar privacy issues. Researchers cite the iCloud Hide My Email vulnerability, which was detected by a different team in mid-2025, as an example. The security issue in question could cause the real addresses behind pseudo-email addresses to be revealed, and Apple introduced the fix for this problem about a year later.
Although Private Relay has an important place among Apple’s online privacy-focused services, it does not offer a fully comprehensive VPN solution in terms of its working logic. While the feature focuses on protecting internet traffic via Safari, it cannot cover all connections on the device. Therefore, it is important for users to know the scope of privacy tools they use, especially when logging into sensitive accounts. Whether a possible update released by Apple will change this WebKit-based behavior will become clear after the company’s review is completed.
Join Channel