"bypass the configured proxy and send traffic directly from the device, which exposes the user's real network," the researchers said.
What Talal Haj Bakry and Tommy Mysk disclosed
Cybersecurity researchers Talal Haj Bakry and Tommy Mysk reported a set of WebKit behaviors that can reveal a device's real IP address even when Apple's iCloud Private Relay is enabled. iCloud Private Relay, introduced with iOS 15 and available as part of iCloud+, uses a dual‑hop architecture that routes Safari web traffic through two relays so that no single third party — including Apple — can determine both the request origin and the sites visited. The researchers say three features in WebKit are able to bypass those proxy paths and disclose the device's network address.
How the three WebKit features leak real IPs
- DNS prefetching: resolves hostnames through the device's normal DNS path instead of the proxy set by the browser, producing DNS activity that can reveal the device network.
- WebAuthn Related Origin Requests: triggers the operating system's credential service to fetch a validation file directly from the device, allowing the request to originate outside the configured proxy.
- WebTransport: opens a direct HTTP/3 connection that bypasses the proxy entirely, sending traffic from the device rather than via the relay chain.
The researchers wrote that these behaviors "bypass the configured proxy and send traffic directly from the device, which exposes the user's real network," and they said the same leaks also affect Apple's iCloud Private Relay.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePlatforms and browsers affected
WebKit is the default browser engine used by Safari and by all third‑party browsers on iOS and iPadOS; the source lists Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, and others. The issues affect iOS, iPadOS and macOS, and extend to any other WebKit‑based browser that relies on WebKit's proxy configuration APIs. In each of these cases, the researchers said, the device's actual IP address can be leaked through the three features described above.
Exploitability, proof‑of‑concept and partial mitigations
The researchers caution that one of the most consequential paths to a leak runs through WebAuthn, the API used for passkeys. "Any website can configure WebAuthn (the API used for passkeys) in a way that causes WebKit to reveal the browser's real IP address, bypassing both proxy configurations and iCloud Private Relay in Safari," Tommy Mysk told The Hacker News.
Mysk added: "Because of the nature of the bug, the website has to deliberately exploit it to associate the user's current browsing session with the leaked IP address. This does not require any user interaction or the use of passkeys." The researchers published a proof‑of‑concept (PoC) site named "leaks.psylo[.]app" so users can test whether their real IP address is exposed even when Private Relay is on.
The report notes two partial boundaries on impact: not every browser is affected — desktop Chrome is not — and the leaks are mitigated when the user is connected to a VPN, according to Mysk.
Apple's response and recent context
Apple did not immediately respond to a request for comment, but told 404 Media that it is investigating the researchers' report. The disclosure follows earlier privacy failures tied to Private Relay: shortly after the feature's release in 2021, FingerprintJS flagged a WebRTC‑based mechanism that leaked a client's real IP address. It also comes a little over a month after Cupertino addressed a separate vulnerability in its Hide My Email service that allowed some real email addresses to be unmasked under certain conditions.
What this means for end users, security teams, and Apple
- End users: a device's real IP address can be exposed to websites despite iCloud Private Relay — users can test the PoC site "leaks.psylo[.]app" and note that connecting through a VPN mitigates the specific leaks described.
- Security teams and technologists: teams that rely on iCloud Private Relay as a privacy layer will need to monitor WebKit advisories and any fixes from Apple; attention should focus on WebAuthn‑related origin requests, DNS prefetch behaviors, and WebTransport/HTTP/3 handling.
- Apple and product teams: Apple is already investigating the report; given the feature history the company addressed earlier issues in Private Relay and in Hide My Email, further updates to WebKit or Private Relay configurations are the apparent next step.
The researchers have demonstrated a clear technical path by which WebKit behavior can short‑circuit proxying and reveal device IPs; Apple is investigating, users can verify exposure via the published PoC, and the presence of a VPN provides a measurable mitigation. Whether and how quickly WebKit or Apple's services will be changed to close these bypasses remains the immediate question for users and security teams alike.
