Apple Private Relay Flaw Can Expose Users’ Real IP Addresses, Security Researchers Warn

Apple’s Private Relay, a privacy feature designed to conceal users’ IP addresses while browsing with Safari, can reportedly be bypassed due to a number of vulnerabilities, according to security researchers.

The findings were published on Tuesday in a blog post by researchers Talal Haj Bakry and Tommy Mysk, who also launched a website allowing users to check whether their real IP address is exposed despite using Private Relay.

YOU MAY ALSO LIKE: How Long Will A PlayStation 5 Last? What PS5 Owners Should Expect Before The PS6 Arrives

During testing on Tuesday, TechCrunch confirmed that the tool successfully identified its actual IP address.

The issue was first reported by 404 Media. Private Relay is available exclusively to iCloud+ subscribers and is intended to mask a user's IP address while using Safari. Unlike a virtual private network (VPN), however, the feature does not provide system-wide IP protection and only functions within Apple's web browser.

Apple Private Relay Vulnerabilities Linked To WebKit Browser Engine

According to Haj Bakry and Mysk, the problem stems from three features within Apple's WebKit browser engine, which powers all browsers on iOS devices.

The researchers explained in their blog post that these WebKit features can be exploited in ways that undermine Private Relay's ability to conceal a user's real IP address, allowing websites to identify the underlying address in certain circumstances.

To demonstrate the issue, the researchers made a public testing website available so users can verify whether their IP address is leaking while using Apple's privacy service.

Researchers Explain Why They Did Not Report The Flaw To Apple

In a post shared on X, Mysk said the researchers decided against reporting the issue directly to Apple.

"Our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely."

Apple did not immediately respond to a request for comment regarding the findings.

Mysk and his colleagues are also the developers of Psylo, a privacy-focused browser. They said the browser now includes mitigations designed to prevent users' IP addresses from leaking while using Psylo.