Apple Private Relay Isn’t as Secure as the Company Promises

The Apple Private Relay, designed to protect users’ IP address during Safari browsing, presents some unexpected vulnerabilities.

Recent findings by two security researchers highlight how the technology, while promising a high level of privacy, can reveal users’ online identities in specific situations, particularly during the use of passkeys, due to inherent limitations in the WebKit browser engine.

The Promise of Apple Private Relay and the Passkey Problem

Apple has presented Private Relay as an essential tool within the iCloud+ subscription, designed to ensure that neither the websites you visit nor Apple itself can identify the IP address of the person browsing via Safari.

However, security researchers Talal Haj Bakry and Tommy Mysk have recently debunked this narrative, showing that the system isn’t infallible. The crux of the problem lies in Apple’s browser engine, WebKit, and its interaction with modern authentication methods.

The vulnerability clearly emerges when using passkeys, a technology increasingly widespread for secure and passwordless authentication.

The mechanism underlying passkeys requires the device to perform an authentication request that operates outside the browser itself. Because Private Relay is a feature tied exclusively to Safari and does not offer system-wide coverage like a true VPN, this external request bypasses the protection.

Consequently, accessing a service or a website via a passkey on Safari exposes the user to the real risk of revealing their actual IP address, undermining the protection that the feature should guarantee.

An Impact that Goes Beyond Safari

The consequences of this vulnerability are not limited to Apple’s own browser alone. Since WebKit is the core engine required for all browsers available on the iOS operating system, the risk of exposing the IP address extends to other privacy-focused applications.

The use of passkeys also exposes users on anonymity-focused browsers, such as OnionBrowser, and even on the Psylo browser, developed by the same researchers. This pervasiveness of the problem shows how an engine-level vulnerability can undermine the efforts of independent developers trying to offer secure browsing tools within Apple’s ecosystem.

The researchers promptly informed the OnionBrowser developers and the Tor Project, which runs the underlying anonymity network, sharing details of their findings and proposing possible solutions.

Response Times and Precedents

Apple’s response to the disclosure was swift: the company announced that it had launched an investigation into the researchers’ findings.

However, Haj Bakry and Mysk expressed skepticism about the timelines required for the actual resolution of the problem, based on historically not-so-reassuring precedents.

The researchers recalled a similar case involving another iCloud privacy feature, namely Hide My Email. In mid-2025, an independent research team had identified a flaw that allowed this feature to reveal real email addresses hidden behind generated aliases.

Despite the gravity of the situation, Apple took an entire year to implement and deploy a corrective update.