iCloud Private Relay Leaks: What You Need to Know

Fox News Flash has the top headlines. Check FoxNews.com for more.

If you pay for iCloud+ and use Safari, you might have turned on iCloud Private Relay for extra privacy. Apple made this feature to stop websites from seeing your real IP address and location.

Now, security researchers found three ways that some WebKit features can get around this protection.

Researchers Talal Haj Bakry and Tommy Mysk found that DNS prefetching, WebAuthn, and WebTransport can bypass WebKit's proxy setup. Two of these methods can show your real IP address. The other can reveal DNS server info.

What's concerning is that these are normal browser technologies. A website doesn't need you to download a suspicious file for these network requests to happen.

Here's how these iCloud Private Relay leaks work and what you can do to protect your privacy.

Join our free CyberGuy LIVE class on August 29 to learn how to defend against AI scams and financial hacks.

Kurt 'CyberGuy' Knutsson will explain how to set up bank alerts and protect your phone number. No tech experience is needed. You'll get a financial protection checklist and a class recording link.

Reserve your free spot at CyberGuyLive.com.

ARE APPLE DEVICES SPYING? WHAT YOUR IPHONE TRACKS

iCloud Private Relay hides your IP address in Safari, but researchers found WebKit paths that can bypass that protection.

Apple's iCloud Private Relay works with Safari browsing. When you turn it on, Apple sends your Safari requests through two internet relays.

The design keeps any single party from seeing both who you are and which websites you visit. However, the newly found WebKit behavior creates paths around that relay.

The researchers identified three separate mechanisms. Each works a little differently.

Browsers often look up website addresses before you click them. This is called DNS prefetching.

The researchers found that WebKit can send these DNS requests through your device's normal DNS connection. A website could see DNS requests coming from your real network.

This does not directly reveal all your online activities. However, it can expose network info that Private Relay was expected to shield.

The second issue involves WebAuthn, the web standard used by passkeys. Some companies operate several websites and want the same passkey to work across those domains.

According to the researchers, that request happens outside Safari's normal proxied network path. The destination server can receive your device's real IP address.

Importantly, this research does not show that an attacker can steal your passkey. The privacy exposure comes from the network request used during verification.

WebTransport gives websites a faster way to maintain low-latency connections. Certain interactive web services can benefit from that speed.

However, researchers found that WebKit can establish a WebTransport connection directly from your device instead of sending it through the configured proxy.

When that happens, the server can see your actual IP address. Private Relay does not intercept that connection.

SHARED VPN VS DEDICATED IP: WHICH ONE IS RIGHT FOR YOU?

Some WebKit features can send network requests outside Private Relay, potentially revealing your real IP address or DNS info.

The findings matter most if you rely on Safari with iCloud Private Relay to hide your IP address. They can also affect privacy-focused browsers or apps that use WebKit's proxy configuration.

The researchers say VPNs do not suffer from these specific WebKit proxy leaks because a VPN tunnels network traffic at the system level.

That does not mean a VPN eliminates every form of online tracking. Websites can still recognize you through account logins, cookies, and other signals.

If you use Private Relay, there's no reason to panic or switch it off. Most Safari browsing still follows Private Relay's normal privacy architecture.

A website using one of these mechanisms could potentially learn your real IP address or DNS connection info. You may not see an obvious warning when that happens.

Your IP address usually won't reveal your home address. However, it can expose your internet provider and approximate location.

We reached out to Apple for comment on the researchers' findings but did not hear back before our publication deadline.

There are several steps you can take while this WebKit behavior remains a concern.

Turning Private Relay off would remove its protection from Safari traffic that currently travels through Apple's relay system.

On iPhone, you can check it by going to: Settings > your name > iCloud > Private Relay.

Apple also lets you choose between maintaining your general location or using only your country and time zone.

Install new iOS, iPadOS, and macOS updates when Apple releases them.

On iPhone: Settings > General > Software Update.

Apple currently lists iOS 26.6 as its latest iPhone software release. Security and privacy fixes often arrive through operating system updates.

If hiding your real IP address is especially important to you, a reputable VPN offers a different type of protection.

The WebAuthn finding may sound alarming because passkeys are involved. However, the researchers describe an IP-address exposure caused by a related network request.

The browser developer Psylo has already changed how its browser handles the three mechanisms.

Privacy features work best when you understand what they actually protect. I still see value in iCloud Private Relay because it gives Safari users meaningful protection.

Would knowing that a website could bypass Private Relay make you trust the feature less, or would you keep using it while waiting for Apple to address the loopholes?

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt 'CyberGuy' Knutsson is an award-winning tech journalist who has a deep love of technology, gear, and gadgets.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Pratique d'écoute

Pratique d'écoute