Apple’s Private Relay can expose users’ IP addresses during some web activity because of issues in Apple’s WebKit browser engine, researchers Talal Haj Bakry and Tommy Mysk found.
One issue involves passkeys, a password-free login method that can trigger an authentication request outside the browser itself. Because Private Relay is tied to Safari and does not provide device-wide protection like a VPN, a passkey login on Safari can reveal a user’s IP address.
404 Media reported that the authentication request occurs outside the browser when a passkey is used. That creates a gap in Private Relay’s protection, which is designed to hide users’ IP addresses from websites and from Apple while they browse in Safari.
The problem is not limited to Safari. Because all iOS browsers use WebKit, passkey use on other browsers can also expose IP addresses, including privacy-focused apps such as OnionBrowser and the researchers’ Psylo browser.
Bakry and Mysk said in a post on X that they had contacted OnionBrowser and the Tor Project to share their findings and potential fixes. The Tor Project provides the anonymity network used by OnionBrowser.
Apple told 404 Media it is investigating the researchers’ report. The researchers said a fix may take time, citing a separate issue in iCloud’s Hide My Email feature that was discovered by another research team in mid-2025 and was not fixed until a year later.
Featured image credit
