Apple's Private Relay Leaks Your Real IP Address in Safari

App developer/security researchers at Mysk discovered several leaks in Apple's Private Relay and all other browser proxies that allow websites to see your real IP address.

Private Relay is a feature that's meant to hide your IP address from the websites you visit in Safari using a dual-hop architecture where the first hop is run by Apple and the second is run by a third-party provider, preventing either party from getting the full picture of who you are and what site you're visiting.

Three separate leaks allow this protection to be completely bypassed by any website, however. You can check if your browser is affected by visiting a website set up by Mysk.

The flaws not only affect Private Relay, but all other browsers that have a proxy feature as well including browsers that route traffic over the Tor network such as Onion browser, since all browsers on iOS are required to use WebKit.

VPNs work device-wide so they aren't affected by these leaks at all.

The first is via DNS prefetching, a feature meant to speed up page load times. When a website uses DNS prefetching, the site's domain name is resolved using the device's normal DNS path rather than resolving it through the proxy, revealing the real DNS servers of your device.

The second is through WebAuthn, a standard for securely authenticating with websites. It's the web API behind passkeys and FIDO2. Usually passkeys are tied to a specific website's domain name, but Related Origin Requests allow a single passkey to be used across several domains owned by the same entity.

To accomplish this, an HTTPS request need to be made to see which domains are allowed. WebKit hands the process off to the operating system's credential service which then makes the request outside of the browser's proxy.

The third leak uses WebTransport, a feature that allows web developers to open connections to other servers. Using this feature opens a connection straight from the device, bypassing the browser's proxy.

The researchers didn't report the issue to Apple and instead released it to the public immediately, citing the excessively long wait times and previous rejections from them:

We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing. A year’s timeline not an exaggeration either: Researchers at EasyOptOut reported to Apple in June 2025 that iCloud Hide My Email leaks real email addresses behind private aliases, and Apple got around to it in July 2026, just about 13 months later.