WebKit Flaws Expose Real IP Addresses of Apple Private Relay and iOS Tor Users
Security researchers reported three WebKit flaws disclosed Aug. 4 that can bypass Apple iCloud Private Relay and reveal users’ real IP addresses, including via passkey-related checks without user interaction. Researchers said the passkey leak has been present since iOS 18.0 (Sept. 2024) and may affect iOS proxy tools like OnionBrowser. Apple said it is investigating.
How this was made
The 30-second read
Why it matters
Potential user privacy harm and reputational damage for Apple’s privacy suite, plus possible follow-on regulatory scrutiny of passkey and anonymity/proxy behavior on iOS. The article also notes Apple is investigating and that the passkey pathway has been present since iOS 18.0.
Market read
Traders may reassess Apple’s privacy/security risk profile following a new, concrete vulnerability disclosure affecting Private Relay and iOS anonymity tooling.
What to watch
The article does not state whether Apple has already mitigated the specific vectors, whether exploitation requires specific attacker setup, or whether regulators will act; those details could swing the risk assessment.
Background
Security researchers report three WebKit flaws (DNS prefetching, WebAuthn-related origin requests, WebTransport) that can send traffic outside iCloud Private Relay’s proxied path, with a passkey validation fetch being the most exploitable.
Ticker impact
Researchers disclosed WebKit flaws that can bypass iCloud Private Relay and expose real IPs for Apple Private Relay and iOS Tor users.
Near-term sentiment pressure is possible, but magnitude is likely limited unless Apple confirms severity and timelines for fixes or regulators escalate.
The article is a security vulnerability disclosure tied directly to Apple’s shipped iOS 18 passkey pathway and Private Relay behavior, but it does not provide confirmed exploitation scale, patch status, or quantified financial impact.
Market effects
Highlights systemic browser-engine privacy risks for mobile platforms and may increase scrutiny of passkey and proxy-anonymity implementations across the ecosystem.
Primarily US-listed Apple sentiment spillover; limited direct regional linkage beyond privacy/regulatory attention.
Privacy and security disclosures can trigger international regulator and consumer-protection attention, affecting global iOS trust perceptions.
Counterpoint
If Apple quickly patches and the test page reflects limited real-world exploitability, the market may treat this as a contained security issue rather than a material business threat.
Key entities
- productApple iCloud Private Relay
Apple’s paid privacy service that is reportedly bypassable via WebKit flaws, exposing real IP addresses.
- platformiOS 18.0 passkey pathway
The passkey validation fetch vector reportedly shipped in iOS 18.0 (Sept 2024), enabling long-running exposure.
- appOnionBrowser (Tor client)
Proxy-based anonymity tool on iOS reportedly affected because iOS requires WebKit for browsers.
- companyApple
The subject of the disclosure; Apple says it is investigating.
