Apple WebKit Vulnerability Exposes Real IP Addresses on Paid iCloud Private Relay

Security flaws discovered in Apple Inc.‘s WebKit browser engine are exposing the real IP addresses of users using its paid iCloud Private Relay service and other privacy-focused iOS applications, security researchers revealed.

The vulnerabilities allow web servers to bypass application-level proxy settings and extract real network identifiers without user interaction or prompts. The findings, published by security researchers Talal Haj Bakry and Tommy Mysk and verified through a proof-of-concept test by tech outlet 404 Media, affect Safari as well as third-party browsers operating on iOS.

Apple has acknowledged the report and updated its internal tracking to indicate plans to fix the issue, targeting a fix for fall 2026. The Cupertino, California-based company separately confirmed to 404 Media that it is actively investigating the matter.

At the center of the leak are three specific WebKit features: WebAuthn Related Origin Requests, DNS prefetching, and WebTransport. The most severe exposure stems from WebAuthn, the standard underlying passkey authentication. Since the release of iOS 18, WebAuthn triggers credential requests directly from the device rather than routing them through Safari’s proxy layer, exposing the user’s origin IP address directly to destination servers in the background.

Additional exposure channels were introduced in later software updates. DNS prefetching, available since iOS 26, leaks users’ actual DNS server addresses. Meanwhile, WebTransport, introduced in iOS 26.4, establishes direct HTTP/3 connections that bypass proxy shields entirely.

Unlike traditional virtual private networks (VPNs) that encrypt all system-level traffic, iCloud Private Relay operates as a dual-hop proxy available to paid iCloud+ subscribers starting at $0.99 per month. Traffic leaving Safari is routed through two separate relays to split user identities from web destinations, a mechanism designed to prevent both Apple and network providers from tracking browsing behavior.

The WebKit vulnerabilities extend beyond Apple’s native browser because Apple has historically mandated WebKit for all iOS web browsers. While recent regulatory shifts under the European Union’s Digital Markets Act have begun forcing Apple to allow alternative browser engines in Europe, WebKit remains the underlying foundation for iOS browsers globally.

As a result, third-party privacy browsers relying on proxy mechanisms have also been compromised. Developers of Psylo issued version 1.3.1 to mitigate the risk by blocking DNS-prefetch hints and disabling WebTransport and WebAuthn by default. The Onion Browser, associated with the Tor ecosystem, neutralizes WebTransport leaks under its stricter “Silver” security setting, though developers noted other WebKit-level leaks remain outside their direct control.

The discovery marks the second recent privacy vulnerability tied to Apple’s paid security suite. Last month, a security flaw in Apple’s Hide My Email feature was disclosed, showing that anonymous email aliases could expose users’ actual email addresses—a bug Apple patched shortly after public disclosure despite receiving private notifications more than a year prior.