Security researchers have discovered a problem with Apple’s iCloud Private Relay service. While the feature is meant to protect your real IP address, it might actually be leaking it to websites.
A new iCloud Private Relay problem
This iCloud Private Relay vulnerability was discovered by security researchers Tommy Mysk and Talal Haj Bakry, who detailed the problem in-depth on their website.
“In short: any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on,” they say.
As a refresher, iCloud Private Relay is not a VPN. As we’ve explained before, it only protects your IP address in Safari, whereas VPNs protect all traffic from your device by running at the system level.
As 404 Media explains, the problem is due to a series of issues in Apple’s WebKit engine and how it handles passkeys.
The impact of the problem is worsened on iOS, where all browsers are required to use Apple’s WebKit engine (in most countries):
Mysk says they reported the problem to Apple, which said it was “dire.” Nonetheless, the company reportedly didn’t provide a timeline on when the problem will be fixed, but agreed to let Mysk disclose it anyway.
You can check whether the problem impacts you via a website set up by the security researchers.
Today’s report follows a separate bug impacting Apple’s Hide My Email feature. This vulnerability, which allowed anyone to access a user’s real email address, was fixed by Apple last month.
Chance’s favorites
- AirPods Pro 3: $199 (Reg. $249)
- Logitech MX Master 4: $119.99
- LG 48-inch OLED evo AI C6 $1,300 (Reg. $1,600)
- LG 55-inch OLED evo AI C6 $1,600 (Reg. $2,000)
- LG 65-inch OLED evo AI C6 $2,000 (Reg. $2,600)
Follow Chance: Threads, Bluesky, Instagram, and Mastodon.
