Apple's Private Relay Fails to Hide IP Addresses Due to WebKit Flaw

Executive Briefing

• Researchers Talal Haj Bakry and Tommy Mysk discovered WebKit flaws exposing user IP addresses despite Private Relay being active
• Passkey authentication triggers requests outside Safari, bypassing Private Relay's IP masking protections entirely
• Affects all iOS browsers using WebKit, including privacy-focused tools like OnionBrowser and Psylo browser
• Apple confirmed it is investigating but fixes may take considerable time, citing a similar Hide My Email bug that took a year to patch