Apple Private Relay leaks real IP address due to WebKit flaws

A flaw in Apple’s Private Relay feature can expose a user’s real IP address while browsing with Safari, researchers disclosed on August 5, 2026.

The opt-in tool, available to iCloud+ subscribers, is designed to mask IP addresses within Safari, unlike a VPN that works system-wide.

Talal Haj Bakry and Tommy Mysk detailed the issue in a blog post on August 5, 2026, and set up a website where users can test for IP address leaks.

TechCrunch confirmed on August 5, 2026 that the test site revealed its real IP address.

The problem stems from three features in WebKit, the browser engine used by all iOS browsers, which undermine Private Relay’s ability to hide IP addresses.

Bakry and Mysk said they chose not to report the vulnerability to Apple, citing past experiences of delays, inconsistent communication and denial of impact.

Apple did not immediately respond to a request for comment on August 5, 2026.

Mysk and his team have developed a private browser called Psylo, which they say includes mitigations to prevent such IP address leaks.

The disclosure was first reported by 404 Media.