PLATFORMS Signal 413
PSA: Apple’s Private Relay can leak your real IP address
↗
A flaw in Apple’s Private Relay implementation can expose a user’s actual IP address while browsing with Safari.
Engineers who depend on Private Relay for client-side privacy can no longer assume the IP is hidden, which may affect compliance and threat-model assumptions. The leak is tied to three WebKit components, meaning any iOS-based browser using that engine inherits the same vulnerability. Mitigations will require either switching to a different browser or adding extra network-level protection such as a VPN.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The vulnerability stems from three WebKit features that allow the real IP to be recovered despite Private Relay being active.
Private Relay only masks IPs in Safari and for iCloud+ subscribers; it does not provide system-wide VPN-style protection.
Researchers have published a test site to verify leaks and have built a separate browser with built-in safeguards.
THE READ
What elseif makes of it.
Apple’s Private Relay, marketed as an IP-masking service for Safari users, contains a series of implementation errors that let a site determine the user’s true address. The problem is rooted in the browser engine rather than the network layer, so any application built on WebKit inherits the same exposure. This means that developers cannot rely on Private Relay as a universal privacy shield for iOS apps that embed WebKit components.
The leak can be demonstrated with a publicly available testing page that reports the actual IP even when Private Relay is enabled. Engineers should treat this as a functional failure of the feature, not a configuration issue, because the underlying engine behavior is at fault. Consequently, any security controls that assumed Private Relay would hide the IP need to be re-evaluated.
Because Private Relay is limited to Safari and iCloud+ accounts, it does not replace a full-system VPN. Teams that require consistent IP obfuscation across all network traffic must adopt additional solutions, such as configuring a VPN or using browsers that have implemented mitigations. The researchers’ alternative browser, Psylo, includes fixes that prevent the leak, offering a potential short-term workaround for privacy-sensitive workloads.
Apple has not commented on the issue, and the researchers chose not to disclose it directly to the company due to past experiences with delayed responses. This lack of official remediation means that the vulnerability remains present in current releases of iOS and macOS. Organizations should monitor for any future patches from Apple and plan for interim mitigations now.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER