Apple's iCloud Private Relay Leaks Real IP Addresses via WebKit Flaws
Paying extra for premium privacy tools sounds great until a few quiet background requests render the whole thing completely useless. Apple's flagship stealth feature just took a massive hit.
Security researchers discovered three separate bypass methods in the WebKit rendering engine that completely expose user IP addresses. The flaws impact both Safari and third-party browsers running on iOS and macOS, rendering the built-in dual-hop proxy architecture useless.
The simplest leak triggers through WebAuthn passkey requests. When a site requests authentication credentials for an external domain, the request gets handed off to a system background service rather than the browser. This system service happily contacts the target server directly, completely bypassing the relay proxy without triggering a single user prompt.
Two additional bypasses leverage modern web standards that were added in recent operating system updates. DNS prefetching sends unproxied domain lookups directly to standard resolvers, while direct HTTP/3 and QUIC connections via WebTransport establish direct sockets that ignore proxy rules entirely.
Security researchers warned Apple about the vulnerabilities prior to publishing their report. While the company authorized the public disclosure, no official timeline or patch release date has been provided for affected systems.
So-called unbreakable privacy features often boil down to marketing promises that crumble the moment system services interact with the web. Trusting corporate walled gardens for anonymity remains an amusing gamble for modern internet users.
Source: mysk.blog
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.