A feature Apple sells to keep web browsing private is quietly giving up its users’ locations. Researchers found that websites can pull the real IP address out of the protection without any visible warning.
Tommy Mysk and Talal Haj Bakry documented the flaw in iCloud Private Relay and published their findings Tuesday. Any site that supports passkeys, or merely pretends to, can see a subscriber’s true IP address. 404 Media first reported the work and verified the leak in its own tests.
The issue lies in how WebKit hands passkey logins to the operating system. Under the WebAuthn standard, the private key stays on the device, and the system’s credential service sends the network request itself, outside the browser’s proxied path. Private Relay never sees that traffic, so the destination server receives the device’s real address. No passkey prompt appears, giving victims no sign their location was exposed.
Two more WebKit features add to the problem. DNS prefetching, new in iOS 26, reveals the user’s actual DNS servers, while WebTransport, added in iOS 26.4, can expose an IP address. Since every browser on iOS must use WebKit, the flaws also reach OnionBrowser, a Tor client, whose maintainers called the situation dire.
Apple told 404 Media it is investigating the report. Mysk’s filing with Apple shows a fix planned for Fall 2026, and the researchers built a test page at leaks.psylo.app so users can check whether their address is exposed. Until a patch lands, a full VPN offers stronger protection.
The disclosure follows last month’s Hide My Email bug, which let outsiders discover subscribers’ real email addresses before Apple patched it. Together, the two cases suggest Apple’s paid privacy add-ons deserve closer scrutiny.
