All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
On paper, Apple promises that Private Relay — a premium feature only available when you purchase an iCloud+ subscription — masks your IP address and encrypts your DNS requests while browsing in Safari. The idea is to make it much harder for anyone to track your browsing activity or identify where you're connecting from.
However, security researchers have uncovered new technical issues in WebKit,[1] the browser engine every iOS browser is required to use, that's allowing some traffic to bypass Apple’s Private Relay protection.
A leaked IP address doesn’t just reveal your general location, but it can also allow websites, advertisers, or other third parties to link your browsing activity to the same device over time, build a profile of your online behavior, and potentially expose your identity. The most unsettling part is that all of this happens silently, without any warning or pop-up for the user.
Here’s what the researchers found and what you can do to protect your digital privacy right now.
Security researchers Talal Haj Bakry and Tommy Mysk were investigating a bug reported by a user who noticed DNS leaks when visiting certain websites while using Psylo, a WebKit-based iOS browser.
As they investigated further, they discovered three separate leaks in WebKit that could bypass a browser’s proxy settings and expose a user’s IP address.
This is the most pressing issue of the three leaks. Researchers identified an issue involving WebAuthn, a standard used for signing in to websites with passkeys. Normally, a passkey is tied to a specific website domain. However, the Related Origin Requests extension allows a company to use the same passkey across related domains.
For this to work, the browser must fetch a JSON file from the target domain to verify that it is authorized to use shared passkeys.
However, this verification is not handled through Safari’s Private Relay but through the operating system’s credential service. As a result, the validation request is sent directly from the device, bypassing Apple’s Private Relay configuration and allowing the destination server to see the device’s IP address.
The concerning part is that a website does not need a user to actually have a passkey for its domain. It can still ask the browser to check for a passkey tied to any domain of its choosing. That alone is enough to trigger the validation request and expose the user’s IP address.
When you visit a website whose HTML code includes a DNS prefetch tag, the browser resolves the hostname before it is actually needed so that, when you later connect to that hostname, the website loads faster.
However, researchers observed a bug under which WebKit performs this DNS prefetching outside Apple’s Private Relay configuration. As a result, WebKit resolves the hostname through the device’s normal DNS path, allowing the website to see your IP address.
Malicious actors could even embed a unique, per-visitor hostname in these tags, enabling them to track a particular visitor’s real network.
WebTransport is a newer alternative to WebSocket, offering low-latency, bidirectional connections using QUIC. Once established, the connection stays open, allowing data to flow back and forth quickly.
When you visit a website whose JavaScript uses WebTransport, your browser opens a direct connection. However, researchers found a bug that allowed WebKit to establish this connection outside Apple’s Private Relay proxies, allowing the WebTransport server to see the device’s real IP address.
This is not the first time that one of Apple’s paid privacy features has failed to do exactly what it was designed for.
Earlier in July 2026, researchers, as reported by 404 Media, highlighted vulnerabilities in Apple’s Hide My Email feature, a privacy tool designed to use disposable email addresses to hide a user’s real email address. Researcher Tyler Murphy said that “100% of Hide My Email addresses were exploitable.”
What’s more surprising is that the research team had reportedly informed Apple of the issue at least a year before publishing the report, yet Apple did not address it. It was only after 404 Media publicly disclosed the vulnerability that Apple released a fix.
This isn’t even a new pattern. In 2020, Apple introduced the Private Wi-Fi Address feature, which claimed to randomize a device’s MAC address to prevent third parties from tracking a user’s movements and location over time.
However, in 2023, researchers found that Apple devices were also leaking the real MAC address alongside the randomized one by embedding it in the same network traffic that was meant to be obscured.
The issue was discovered by the same security researchers behind the current Private Relay report and was tracked as CVE-2023-42846. Apple patched the vulnerability only after the researchers disclosed it, releasing a fix at the end of October 2023.
More recently, even though Apple promises that it reviews every app before listing it on the App Store, it let a fake Bitcoin wallet app slip through. As a result, three users allegedly lost around $1.84 million after downloading the fraudulent app.
These bugs have not only affected Apple’s Private Relay but also any WebKit-based browser on iOS or macOS that uses the app-level proxy API to route traffic.
This also includes the researchers’ own browser, Psylo. In addition, Onion Browser, a well-known Tor browser for iOS, has also been affected.
If you’re using any of these tools to hide your network activity, here’s what you can do to stay safe.
Unfortunately for a brand like Apple — whose identity is built around privacy as a competitive advantage — it’s now becoming a repeat offender when it comes to falling short on its own privacy promises.
Unfortunately, there is very little you can do to fix the WebKit issues that can expose your IP address to third parties.
If you’re using Apple’s Private Relay or any other WebKit-based iOS browser, you’ll likely need to wait for Apple and other affected browser providers to release patches for these bugs.
In the meantime, you can use a third-party VPN for your internet activity, since these leaks do not affect VPNs.
Our #1 rated VPN, which has increased download speeds by up to 36% across all regions in our testing
Historically unlocks Netflix libraries in the US, Canada, UK, and Australia with no errors
Bundles with ad blocker, data removal, and encrypted storage for a more complete privacy setup
/images/2023/07/07/best-identity-theft-protection-service.png)
/images/2023/10/12/best_identity_theft_protection_with_dark_web_monitoring.jpg)
/images/2026/08/07/apple-private-relay-leak.jpg)
/images/2026/08/06/walmart-voiceprint-lawsuit.jpg)
/images/2026/08/06/gavel_on_european_union_flag_symbolizing_law_and_justice.jpg)
/images/2026/08/06/android-ad-sdks-location-sharing.jpg)
/images/2026/08/05/us-senate-votes-on-kids-safety-bill_Np47hs7.jpg)
/images/2026/08/04/apple-takes-uk-to-court.jpg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2022/05/26/logo-nordvpn.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)