IP address leak discovered in Apple Private Relay

21:58 / 05.08.2026·12·Technology

Serious flaws have been discovered in Apple’s Private Relay feature in the Safari browser, which is designed to protect user privacy. ixbt.com According to information published by ixbt.com and 404 Media, vulnerabilities exist that make it possible to bypass this protection system and identify a user’s real IP address. This is making security an even more pressing issue for millions of subscribers who rely on online privacy. TechCrunch.com reports .

In a blog post published on Tuesday, researchers Talal Haj Bakry and Tommy Mysk explained that the issue is related to three features of WebKit, the web browser engine used by all browsers on iOS devices. They said the flaw prevents the privacy tool from performing its function fully and exposes real network addresses.

Privacy and VPN differences

As experts pointed out, Private Relay is not a conventional VPN (Virtual Private Network) service. While a VPN protects data at the system level, Apple’s feature works only within the Safari browser. The service is also available exclusively to paid iCloud+ subscribers. As a result, users may be put at risk while believing that their online activity is fully concealed.

The researchers who exposed the issue launched a dedicated website. It allows anyone to check whether their real IP address is leaking even when Private Relay is enabled on their device. TechCrunch staff also confirmed during tests on Tuesday that the website successfully detected their real IP addresses.

Relations with Apple and future measures

Researcher Tommy Mysk wrote on his X social media page that they had decided not to formally report the vulnerability to Apple. According to him, previous experience showed that communication with the company could drag on for months, reports might be ignored, and in some cases the impact of the issue could be denied entirely. Apple has not yet issued an official comment on the matter.

Nevertheless, the experts who identified the issue said they had added special safeguards to the Psylo private browser they are developing to prevent similar IP address leaks. Such failures in the technology sector once again show that systems designed to protect user data must be continuously improved.