Apple’s Private Relay Could Expose Your IP Address to Online Services and Websites
Although designed to conceal your IP address, researchers have revealed that this feature may sometimes fail due to issues in WebKit.
Apple’s Private Relay aims to keep your IP address hidden from websites and even from Apple itself while you navigate on Safari. However, security experts Talal Haj Bakry and Tommy Mysk found that the feature may not always function properly due to issues with Apple’s browser engine, known as WebKit.
One key problem relates to the use of passkeys, which are increasingly popular as a secure, password-free way to log in. When logging in using a passkey, the authentication request is made outside the browser. Since Private Relay is tied to Safari and doesn’t protect your identity across your entire device like a traditional VPN, your IP could potentially be exposed if you log into a service using a passkey on Safari.
This risk extends beyond Safari as the WebKit issue affects all browsers on iOS. Thus, if you’re using privacy-focused browsers like OnionBrowser or the Psylo browser, your IP could still be at risk when utilizing passkeys.
The researchers mentioned they’ve reached out to OnionBrowser and the Tor Project to inform them of their findings and possible solutions. In response, Apple has acknowledged the researchers’ report and indicated that an investigation is underway. However, the researchers cautioned that it could take considerable time for Apple to implement a fix, referencing a previous issue with iCloud’s Hide My Email feature that took over a year to address after it was identified in mid-2025.
