Apple's iCloud Private Relay is sold on a simple promise: websites you visit in Safari should not learn your IP address or your location. Researchers Talal Haj Bakry and Tommy Mysk say three ordinary WebKit features quietly break that promise, and a site does not have to do anything clever to use them.
The problem is where the connections come from. Private Relay is built as a proxy inside WebKit, so it only sees traffic that travels WebKit's normal page loading path. All three of the mechanisms the pair documented in their report, published on August 4, start outside that path. The relay never sees them, so it cannot route them, and the server on the other end gets the device's real address instead of the relay's.
The three leaks
The first is DNS prefetching, a speed optimization in which the browser resolves the hostnames of links on a page before you click them. WebKit added it in iOS 26.0. Those lookups go through the system's normal DNS stack rather than the proxy, and because a page can plant a unique hostname per visitor using a dns-prefetch hint, the authoritative DNS server for that domain can watch the query arrive from the visitor's real network.
The second involves WebAuthn, the standard behind passkeys, and it is the one the researchers treat as most serious. To confirm a credential is being used on the right site, the operating system's credential service fetches a small validation file from the website's domain. On Apple platforms that fetch happens outside WebKit's page loading path, so it never goes through the proxy. A page can trigger it through the rpId parameter with no user interaction at all, which means simply loading a site is enough to hand over your real IP address. The feature has been present since iOS 18.0.
The third is WebTransport, an API for low latency two-way connections that arrived in iOS 26.4. It opens a direct QUIC connection to the server, and WebKit never passes the proxy settings along, so the server logs the device address.
What's affected
Safari with Private Relay enabled on iOS and macOS is affected, but the reach is wider than Apple's own product. Any app that relies on WebKit's proxy configuration to hide an IP address inherits the same behavior. That includes the privacy browser Psylo and iOS Tor browsers such as Onion Browser, with the researchers noting Onion Browser is protected at its Silver security level with Lockdown Mode enabled. System-level VPNs that tunnel all device traffic are not affected, because they never depended on WebKit's proxy in the first place.
What you should do
No CVE has been assigned and there is no Apple fix yet. Malwarebytes, which flagged the research in its own write-up, says the researchers have reported the problems to Apple and expect patches in the fall.
If hiding your IP address genuinely matters for your threat model, do not rely on a browser-level proxy to do it in the meantime. A full-device VPN tunnel is not affected by any of this. Psylo shipped mitigations in version 1.3.1, blocking dns-prefetch hints and disabling WebTransport and WebAuthn by default with an opt-in per site, which is a reasonable template for what a browser-level fix has to look like. Users of proxy browsers should update and check whether those features are still enabled.
The full technical write-up, including how each mechanism can be triggered, is in Bakry and Mysk's report. It follows a run of WebKit security work this year, including the chainable WebKit bugs Apple patched in June, and lands alongside separate research showing malware stealing Google passkeys outright, a reminder that the passkey ecosystem's edges are getting real scrutiny.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.