---
title: "Vulnerability in WebKit: iCloud Private Relay May Reveal User's Real IP Address"
description: "🔍 Vulnerability in iCloud Private Relay: Apple feature may reveal real IP address. Researchers identified issues in WebKit allowing sites to track users. Check yourself on leaks.psylo.app! #Apple #Privacy #CyberSecurity"
date: 2026-08-06T08:20:01.000Z
lang: en
url: https://xab.info/en/posts/vulnerability-in-webkit-icloud-private-relay-may-reveal-real-ip-address
tags: [apple, icloud-private-relay, cybersecurity, webkit, privacy, ios, vpn, tor]
publisher: "XAB.info"
---

# Vulnerability in WebKit: iCloud Private Relay May Reveal User's Real IP Address

![Person using iPhone with iCloud Private Relay, illustrating WebKit vulnerability exposing real IP address](https://xab.info/media/2026/08/06/uязvimost-v-webkit-icloud-private-relay-mozhet-raskryvat-realnyy-ip-adres-polzovatelya/uязvimost-v-webkit-icloud-private-relay-mozhet-raskryvat-realnyy-ip-adres-polzovatelya-1.webp)

## 🎯 Key Points

- iCloud Private Relay may reveal the user's real IP address due to vulnerabilities in WebKit
- Link preloading and access key verification bypass iCloud Private Relay protection
- VPN users remain safe as traffic is encrypted at the system level
- Psylo developers released an update and created an IP leak test
- Apple received data on vulnerabilities to fix them in future iOS updates

One of Apple's key features designed to ensure user privacy on the internet — iCloud Private Relay — has proven to be less reliable than previously claimed. Under certain conditions, the mechanism may reveal real network data, including the device's IP address.

This is reported by RBC-Ukraine, citing research by independent cybersecurity expert Tommy Mysk (Mysk) and his colleague Talal Haj Bakri.

### The problem lies in WebKit

The main cause of the vulnerability is the use of the WebKit engine, which is mandatory for all browsers distributed via the App Store. According to Apple's rules, any browsers on iOS must run on this engine, which limits third-party developers' capabilities in data protection.

Researchers have identified several scenarios where iCloud Private Relay does not provide full traffic anonymization:

  - **Link preloading:** To speed up page loading, the browser may request the addresses of links contained on a site in advance. These requests are made through the regular internet provider, bypassing the secure iCloud Private Relay channel. As a result, the site may record the user's real IP address.

  - **Access key verification:** When using modern authentication methods (e.g., WebAuthn), key authenticity verification is performed at the iOS operating system level, not through the browser. This process occurs without considering privacy settings and connects directly to the server, revealing the real IP.

  - **Direct connections:** Some iOS functions designed to accelerate data transfer are launched directly from the device and ignore proxy or protection settings, including iCloud Private Relay.

### Who is at risk?

All iCloud Private Relay users are at risk, as well as those using specialized anonymous browsers or Tor browsers on iPhone and Mac. Unlike them, users of traditional VPN services remain safe, as VPN works at the system level and encrypts all device traffic without exceptions.

### Contradictory data

There is a difference in protection approaches: Apple positions iCloud Private Relay as a reliable tool for anonymization, yet researchers show that in real-world conditions, it does not ensure complete privacy. On one hand, Apple claims the feature hides the IP address and browser history from the provider and websites. On the other hand, experts demonstrate that under certain conditions (link preloading, key verification), the real IP may be revealed.

This creates a situation where users may rely on protection that does not work fully in practice. Apple has not yet issued an official comment, but researchers have already submitted the data to the company to fix vulnerabilities in future iOS updates.

### Community reaction

Developers of the anonymous browser Psylo have already released an update that forcibly disables dangerous functions capable of revealing the IP address. Specialists have also created a website [leaks.psylo.app](https://leaks.psylo.app), where any user can check in one click whether their iPhone is leaking the real IP address when using iCloud Private Relay.

### What should users do?

Until Apple fixes the vulnerabilities, experts recommend:

  - Use trusted VPN services for full traffic protection.

  - Check your IP address on leaks.psylo.app.

  - Disable iCloud Private Relay if maximum anonymity is required.

  - Monitor iOS updates, where the identified issues will likely be fixed.

The situation highlights the importance of a critical attitude towards privacy claims and the need for independent auditing of data protection technologies.

## 🔍 Fact-Check Verification

- [Как скрыть использование VPN на iPhone: подробная инструкция - SecurityLab.ru](https://www.securitylab.ru/analytics/564452.php) - The source confirms the importance of using a VPN to protect traffic on iOS, which aligns with researchers' findings about the insufficiency of iCloud Private Relay.