Apple’s iCloud Private Relay May Expose Users’ Real IP Addresses Due to WebKit Flaws: Report

Apple introduced iCloud Private Relay in 2021 as a new privacy service that allows users to connect to and browse the Web more securely and privately. However, security researchers say that it may not be able to fully protect users’ IP addresses under certain circumstances. According to a report, the issue reportedly stems from multiple vulnerabilities in WebKit, potentially allowing websites to learn a user’s real IP address even when iCloud Private Relay is enabled.

iCloud Private Relay Affected by WebKit Vulnerabilities

Security researchers Tommy Mysk and Talal Haj Bakry discovered three WebKit features that bypass configured proxy services and expose a device’s real network information (via 404Media). According to the findings published on the Mysk Blog, the affected features include DNS prefetching, WebAuthn Related Origin Requests, and WebTransport. They are reportedly susceptible to initiating network requests outside WebKit’s standard proxy path, revealing a user’s real IP address or DNS information.

Since such requests occur outside of the normal Safari browsing process, it reportedly makes iCloud Private Relay vulnerable, too. In the case of WebAuthn, which powers passkeys, the operating system’s credential service fetches a validation file directly from the destination server instead of routing the request through Private Relay. Consequently, websites that support passkeys can reportedly determine a visitor’s real IP address despite Private Relay being enabled.

The report also states that DNS prefetching resolves domain names using the device’s standard DNS path rather than the configured proxy, which can expose users’ real DNS servers. Meanwhile, WebTransport reportedly establishes direct HTTP/3 connections from the device, ultimately bypassing proxy configurations and revealing the user’s actual IP address.

According to the researchers, these issues affect WebKit-based browsers on both iOS and macOS that rely on the WKWebsiteDataStore.proxyConfigurations API for proxying web traffic. VPN services, however, are claimed to remain unaffected because they normally route all traffic through an encrypted tunnel at the OS level.

Researchers say they informed Apple about the findings before publicly disclosing them. A proof-of-concept website has also been published that allows users to check whether their IP address is being exposed through these vulnerabilities.