Apple's Private Relay, an opt-in feature designed to hide users' IP addresses when browsing with Safari, can be circumvented to reveal the supposedly hidden IP address, according to researchers.
The flaws were detailed in a blog post on Tuesday by Talal Haj Bakry and Tommy Mysk, who also set up a website where anyone can check if their real IP address leaks. TechCrunch verified the leak in a test on Tuesday.
The issue stems from three features in Apple's WebKit browser engine, which is used by all browsers in iOS. Private Relay is only available to iCloud+ subscribers and works only in Safari, unlike a VPN which protects at the system level.
Mysk wrote on X that they chose not to report the issue to Apple because "our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue's impact entirely." Apple did not immediately respond to a request for comment.