AnswersPublished22 sources
Three WebKit Flaws Let Websites Discover Your Real IP Despite Apple's iCloud Private Relay
On August 4–5, 2026, researchers Tommy Mysk and Talal Haj Bakry disclosed three WebKit flaws that leak a user's real IP address even when Apple's iCloud Private Relay is enabled. The other two leaks involve DNS prefetching (iOS 26.0), which exposes real DNS servers via a normal DNS lookup, and WebTransport connectio...
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What security vulnerabilities were discovered in Apple's iCloud Private Relay and how do they expose users' real IP addresses despite the fe. Article summary: On **August 4–5, 2026**, security researchers **Tommy Mysk** and **Talal Haj Bakry** (Mysk) disclosed **three WebKit vulnerabilities** that cause Apple's iCloud Private Relay to leak a user's real IP address, defeating t. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
Apple's iCloud Private Relay, a paid privacy feature designed to hide your IP address and DNS information while browsing in Safari, has been found to leak that very information due to three vulnerabilities in WebKit, the browser engine that powers every browser on iOS.
The flaws were disclosed on August 4–5, 2026, by security researchers Tommy Mysk and Talal Haj Bakry (collectively known as Mysk). The issues affect all browsers on iOS (which are WebKit-based) and Safari on macOS . As of August 6, 2026, Apple has not yet released patches
.
How iCloud Private Relay Is Supposed to Work
iCloud Private Relay routes your Safari traffic through two separate proxy hops to hide your IP and DNS from the destination website. It is not a full-device VPN; it only protects traffic within Safari . These newly discovered WebKit bugs allow network requests to exit the browser process entirely before the proxy routing applies, meaning the destination server sees your real IP, not the relay's egress IP .
Studio Global AI
Search, cite, and publish your own answer
Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.
People also ask
What is the short answer to "Three WebKit Flaws Let Websites Discover Your Real IP Despite Apple's iCloud Private Relay"?
On August 4–5, 2026, researchers Tommy Mysk and Talal Haj Bakry disclosed three WebKit flaws that leak a user's real IP address even when Apple's iCloud Private Relay is enabled.
What are the key points to validate first?
On August 4–5, 2026, researchers Tommy Mysk and Talal Haj Bakry disclosed three WebKit flaws that leak a user's real IP address even when Apple's iCloud Private Relay is enabled. The other two leaks involve DNS prefetching (iOS 26.0), which exposes real DNS servers via a normal DNS lookup, and WebTransport connections (iOS 26.4), which open direct HTTP/3 sessions that bypass the proxy entirely.
Sources
- macrumors.comApple's iCloud Private Relay is Leaking Users' Real IP ...
- techcrunch.comPSA: Apple's Private Relay can leak your real IP address
- 404media.coApple's 'Private Relay' Is Exposing Users' Real IP Addresses
- macobserver.comApple Private Relay flaw leaks users' real IP addresses through passkeys
- cybersecuritynews.comApple iCloud Private Relay WebKit Flaws Leak Users’ Real IP Addresses