Researchers expose flaw that lets Apple Private Relay reveal real IP addresses

A pair of security analysts discovered that Apple’s Private Relay, an optional feature for iCloud+ users meant to mask IP addresses in Safari, can be circumvented due to three flaws in the WebKit engine used across iOS browsers. Their findings were detailed in a blog post and accompanied by a public website that checks whether a device’s real IP is being leaked; one outlet verified the site’s ability to expose its own address.

The vulnerability was initially flagged by one outlet, and the researchers explained they did not report it to Apple because of previous experiences with slow or dismissive responses. Private Relay operates only within Safari and does not function like a full-system VPN. The investigators also develop the Psylo private browser, which now includes protections against the identified leak. Apple has not responded to requests for comment.