iCloud Private Relay leaks can expose your real IP - Fox News

Fox News Flash top headlines are here. Check out what's clicking on FoxNews.com.

If you pay for iCloud+ and use Safari, you may have turned on iCloud Private Relay for an extra layer of privacy. Apple designed the feature to prevent websites from seeing your actual IP address and exact location.

Now, security researchers have found three ways that certain WebKit features can slip outside that protection.

Researchers Talal Haj Bakry and Tommy Mysk discovered that DNS prefetching, a WebAuthn feature connected to passkeys and WebTransport can bypass WebKit's proxy configuration. Two of those methods can expose your real internet protocol (IP) address. The other can reveal information about the DNS servers your device is using.

What makes this especially concerning is that these are legitimate browser technologies. A website does not necessarily need to convince you to download a suspicious file or install a shady app for the network requests to occur.

Here's how these iCloud Private Relay leaks work, who may be affected and what you can do to better protect your privacy.

New! Free live CyberGuy class: Protect Your Money From Today’s Biggest Threats

Join us Saturday, Aug. 29, at 10 a.m. ET for a free CyberGuy LIVE class covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt "CyberGuy" Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. You’ll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

ARE APPLE DEVICES SPYING? WHAT YOUR IPHONE TRACKS

iCloud Private Relay is designed to hide your IP address in Safari, but researchers found WebKit paths that can bypass that protection. (Kurt "CyberGuy" Knutsson)

How iCloud Private Relay is supposed to protect you

The design keeps any single party from seeing both who you are and which websites you visit. That makes Private Relay useful if you want to reduce the amount of location and browsing information websites can collect about you. However, the newly documented WebKit behavior creates paths around that relay.

How WebKit can leak information around Private Relay

The researchers identified three separate mechanisms. Each works a little differently.

DNS prefetching can reveal your real network path

Browsers often try to make websites load faster by looking up the addresses of links before you click them. This process is called DNS prefetching. Normally, you would expect those lookups to follow the same privacy path as the rest of your browsing.

The researchers found that WebKit can instead send these DNS requests through your device's normal DNS connection. As a result, a website could see DNS requests coming from your real network instead of the proxy. The issue has been available on iOS since iOS 26.0, according to the researchers.

This does not directly hand over everything you are doing online. However, it can expose network information that Private Relay was expected to shield.

A passkey-related request can expose your IP

The second issue involves WebAuthn, the web standard used by passkeys. Some companies operate several websites and want the same passkey to work across those related domains. WebAuthn has a feature that lets a device verify whether those websites belong together. To do that, the operating system may contact a website directly to retrieve a small verification file.

According to the researchers, that request happens outside Safari's normal proxied network path. Therefore, the destination server can receive your device's real IP address even while Private Relay is active.

Importantly, this research does not show that an attacker can steal your passkey through this flaw. The privacy exposure comes from the network request used during verification. So, there is no reason to abandon passkeys because of this finding.

WebTransport can create another direct connection

WebTransport gives websites a faster way to maintain low-latency connections with servers. Certain interactive web services can benefit from that speed.

However, researchers found that WebKit can establish a WebTransport connection directly from your device instead of sending it through the configured proxy.