Apple's Private Relay tool can leak users' IP addresses with OnionBrowser also affected

Date:
Thu, 06 Aug 2026 10:35:00 +0000

Description:
While Apple is looking into it, some browser makers have already made their moves.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Researchers Talal Haj Bakry and Tommy Mysk found three WebKit flaws leaking real IPs despite iCloud Private Relay DNS prefetching, WebAuthn origin requests, and WebTransport bypass
proxy settings, exposing users across all Apple browsers Tor and Psylo browsers issued fixes; Apple has not confirmed a patch but is reviewing the report WebKit, Apple s engine that powers all web browsers in its ecosystem, contained multiple flaws that helped leak the IP addresses of users who paid to keep them hidden.

This is according to security researchers Talal Haj Bakry and Tommy Mysk who noted they had found three WebKit features that bypass the proxy
configuration and send traffic directly from the device instead, they wrote. DNS prefetching resolves hostnames through the devices normal DNS path, which reveals the users real DNS servers instead of the proxys. Available since iOS 26.0; WebAuthn Related Origin Requests make the operating system s credential service fetch a validation file directly from the device. This exposes the devices real IP address. Available since iOS 18.0; WebTransport opens a
direct HTTP/3 connection and bypasses the proxy, which also exposes the devices real IP address. Available since iOS 26.4," the researchers said. Latest Videos From TechRadar Watch full video here: Private Relay While the bugs are in WebKit, the leaks come via Private Relay - a privacy feature available with iCloud + that hides a users IP address and encrypts Safari web traffic. Private Relay does not work like a VPN, and does not mask the
traffic flowing through other apps and programs - it just handles browser traffic.

Since WebKit is mandatory for all browsers running in Apples ecosystem, the vulnerability affects all of them. Some, including Tor and Mysks very own Psylo browsers, have already issued fixes. You may like Apples security feature can be duped into supplying the real contact info Mullvad addresses WireGuard exit-IP fingerprinting concern after researcher flags privacy risk Security experts reveal Proton VPN avoids internal tunnel IP fingerprinting
on iOS

Apple, on the other hand, has not yet confirmed a fix, or even that it was working on one. It did say, according to 404 Media , that it was looking into the research report.

The researchers built a dedicated website where users can check if Private Relay is working as intended or still leaking the actual IP address into the wild. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/apples-private-relay-tool-can-leak-user s-ip-addresses-with-onionbrowser-also-affected


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)