In September 2021, Apple launched iCloud Private Relay alongside iOS 15. Available at no extra cost to iCloud+ subscribers, the service routes Safari traffic through two relay servers. The first relay (the ingress proxy) is operated by Apple and sees the user's IP address, but the encrypted destination site name remains hidden from it. The second relay (the egress proxy) is operated by a CDN provider such as Cloudflare, which decrypts the site name to establish the connection but never learns the user's original IP. The design is such that even Apple itself cannot simultaneously know both the IP and the destination.
This architecture differs fundamentally from a VPN. Whereas a VPN tunnels all of a device's traffic at the OS level, Private Relay protects only Safari traffic and certain unencrypted communications. Apple has stated this clearly in its official documentation, but many users have come to think of it as "basically a VPN."
Private Relay has been controversial since its debut. In August 2021, four major European carriers—Vodafone, Telefonica, Orange, and T-Mobile—sent a joint letter to the European Commission calling for regulation, arguing that Private Relay "blocks access to network data and metadata." The UK's TalkTalk also protested, saying it would make it "difficult to block dangerous content." The tension between privacy protection and network management has been baked into this service from the start.
Real IPs leaking through the passkey back door
A report published on August 4, 2026 by security researchers Talal Haj Bakry and Tommy Mysk fundamentally undermined this design premise. Three features present in WebKit were found to bypass proxy settings entirely, sending communications directly from the device and exposing the real IP addresses that Private Relay is meant to conceal.
The most serious of the three is the leak via WebAuthn Related Origin Requests. WebAuthn is the web standard underlying passkeys, an authentication method Apple has actively promoted as a replacement for passwords. Related Origin Requests is an extension that allows a single passkey to be used across multiple domains.
Here's where the problem lies: when a website requests passkey authentication, WebKit hands off the authentication process not to the browser's network stack but to the OS's credential service. When this credential service fetches the verification file (/.well-known/webauthn), it does not recognize the proxy configured by the browser. As a result, the HTTP request is sent directly through the device's native network path, and the destination server receives the user's real IP address rather than the Private Relay IP.
Researcher Tommy Mysk told 404 Media, "Essentially, any website that supports (or claims to support) passkeys can see the real IP address of a user who has iCloud Private Relay enabled."
What makes this leak especially dangerous is that there is no indication whatsoever on the user's side—no passkey authentication prompt, no UI of any kind. If mediation: "conditional" is set, the request fires silently in the background. This has existed since iOS 18.0 (released September 2024), meaning the condition persisted for roughly two years.
Three leak paths and their respective scope of impact
The other two leaks, besides WebAuthn, stem from more recently introduced features.
DNS prefetching resolves hostnames the page hasn't yet visited, based on <link rel="dns-prefetch"> tags found within the page. Desktop Safari has supported this since the Safari 5 era, but on iOS it remained disabled until iOS 26.0 (September 2025). Once enabled, WebKit began performing name resolution through the device's normal DNS path, causing DNS queries that Private Relay was supposed to relay to bypass the proxy entirely. What gets exposed here is not the IP address itself, but information about the DNS server the user is actually using.
WebTransport is a communication protocol designed as a low-latency alternative to WebSocket, running atop HTTP/3 and QUIC. This feature, released in iOS 26.4 (March 2026), establishes a direct QUIC connection from the device whenever new WebTransport(url) is called. Because WebKit does not reference the session's proxy settings at all when building the connection, the server sees the device's real IP.
| Leak path | Information exposed | Introduced | Duration (as of August 2026) | Visibility to user |
|---|---|---|---|---|
| WebAuthn Related Origin Requests | Real IP address | iOS 18.0 (September 2024) | ~23 months | None (fires in the background) |
| DNS prefetching | Real DNS server info | iOS 26.0 (September 2025) | ~11 months | None |
| WebTransport | Real IP address | iOS 26.4 (March 2026) | ~5 months | None |
VPNs unaffected. Proxy-based browsers all fail
These three leaks only affect services that rely on application-level proxying. Because a VPN tunnels all of a device's traffic at the OS level, no matter which path is taken inside WebKit, the traffic ultimately goes out through the VPN server. This is precisely where Private Relay and VPNs diverge in outcome.
On the other hand, proxy-based browsers on iOS are uniformly affected. Apple's App Store policy requires all browsers on iOS to use WebKit. Proxy-based browsers relay traffic via an API called WKWebsiteDataStore.proxyConfigurations, but the three features above ignore this API's settings.
Onion Browser, which offers anonymous browsing via Tor, is also affected. Onion Browser's "Silver" security level enables Lockdown Mode, which fully disables WebTransport, avoiding that particular leak path. However, the WebAuthn and DNS prefetching leaks are outside the control of Onion Browser's developers. The researchers contacted both the Tor Project and Onion Browser's developers in advance; the Tor Project reportedly assessed the issue as "dire."
Psylo, the privacy-focused browser operated by the researchers themselves, addressed all three leaks in version 1.3.1. It blocks DNS prefetch hints and disables WebTransport and WebAuthn by default, while allowing them to be re-enabled on a per-site basis when needed.
Independently verified by 404 Media. Apple plans a fall fix
The researchers have published a proof-of-concept site (leaks.psylo.app) where the leak can be verified. When 404 Media tested the site, it did in fact receive back the real IP address that Private Relay is supposed to hide.
Mysk and Haj Bakry submitted their findings to Apple after publication. The status on Apple's security report has been updated to "planned for a future update," with the fix expected in fall 2026. Apple told 404 Media it was "investigating."
How many websites collected real IPs before the fix ships remains unknown. The researchers note that "many websites may already have collected this information," since passkey adoption is moving quickly and the request can fire simply by loading a related JavaScript library—even without a site intentionally implementing WebAuthn's Related Origin Requests.
A recurring pattern of privacy tool failures
This leak illustrates part of a structural problem affecting Apple's paid privacy tools. In July 2026, a vulnerability in Hide My Email was disclosed. Reported to Apple in June 2025 by Tyler Murphy, co-founder of EasyOptOuts, the issue caused users' real email addresses to leak into logs of emails rejected as spam. Apple claimed to have fixed the issue on July 3, 2026—13 months after the report—but AppleInsider ran a reproduction test on July 17 and confirmed it was still not fixed. It remains unclear exactly when a final fix was completed. In Murphy's volunteer testing, 100% of Hide My Email addresses tested were vulnerable. A class-action lawsuit has also been filed over this issue.
| Hide My Email | iCloud Private Relay (this report) | |
|---|---|---|
| Information leaked | Real email address | Real IP address |
| Time from report to fix | ~13 months | Fall 2026 planned (unfixed as of publication) |
| Duration of leak | Unknown (existed since before June 2025) | ~23 months via WebAuthn |
| Independent verification | 404 Media, AppleInsider | 404 Media |
| User notification | None | None (as of article publication) |
What these two cases have in common is a structure in which Apple positions privacy as a product differentiator, while its implementation-level verification fails to keep pace. Private Relay's two-hop design assumes that traffic passes through "Safari's standard page-loading path." Cases where communication occurs outside that path—such as through the OS's credential service or WebKit's newer connection APIs—fell outside the scope of the original design assumptions.
Questions the fall fix won't close
Whether Apple's planned fall 2026 fix will close all three leaks at once, or arrive as a staged rollout, remains unclear. Disabling WebAuthn's Related Origin Requests would affect legitimate use cases where a passkey is shared across multiple domains. Apple has yet to indicate how it will handle the tradeoff between security and convenience.
Another unresolved question concerns the past two years of data: to what extent, and on which websites' server logs, do the real IP addresses of Private Relay users who visited WebAuthn-enabled sites since iOS 18.0 remain recorded? What the researchers' PoC demonstrated is that "the leak is technically possible"—the actual scale of exploitation is something no one can measure. Even once the patch is distributed, IP addresses already collected will not disappear.