Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses
Security researchers say Apple’s iCloud Private Relay can fail to hide users’ real IP addresses due to issues in iOS/WebKit, including when websites or passkeys trigger OS-level requests. They also report impacts for the iOS OnionBrowser app. A test site allegedly returned real IPs. Apple said it is investigating.
How this was made
The 30-second read
Why it matters
If validated and widespread, the leak undermines the core promise of Private Relay and could trigger user trust erosion, support burden, and potential regulatory inquiries into privacy-by-design claims.
Market read
A newly disclosed privacy-security flaw tied to Apple’s paid anonymity feature creates headline risk and potential catalyst for remediation updates.
What to watch
The article does not include Apple’s technical assessment, patch status, or confirmed prevalence; traders should wait for Apple’s remediation details and any independent validation.
Background
iCloud Private Relay is a paid iCloud+ feature intended to mask users’ IP addresses in Safari; researchers claim iOS/WebKit passkey behavior can bypass the relay path.
Ticker impact
404 Media reports iCloud Private Relay can leak users’ real IP addresses due to iOS/WebKit passkey handling, and Apple is investigating.
Near-term: modest downside bias on privacy/security headlines; medium-term: watch for any Apple remediation timeline, user-impact disclosures, or regulator actions.
This is a concrete vulnerability claim affecting a paid Apple privacy feature, but the text does not provide quantified financial impact, guidance changes, or confirmed scope beyond researcher tests.
Market effects
Highlights systemic privacy and browser-engine security risk for iOS/WebKit-based anonymity tools, potentially increasing scrutiny of Apple privacy claims.
Primarily US-listed Apple headline risk; privacy regulators in multiple jurisdictions could become involved.
Global iOS user base and cross-border privacy expectations make the issue relevant beyond the US.
Counterpoint
Apple may determine the reported leak is limited to specific passkey flows or configurations, reducing practical user exposure and limiting financial impact.
Key entities
- companyApple
Subject of the report, accused of iCloud Private Relay IP leakage due to iOS/WebKit passkey handling; says it is investigating.
- productiCloud Private Relay
Apple privacy feature in iCloud+ designed to mask users’ IP addresses while browsing in Safari.
- appOnionBrowser
iOS Tor browsing app said to be impacted by the same underlying iOS/WebKit issues.
