Apple's Private Relay tool can leak users' IP addresses — with OnionBrowser also affected

Hands on a laptop with overlaid logos representing network security.

• Researchers Talal Haj Bakry and Tommy Mysk found three WebKit flaws leaking real IPs despite iCloud Private Relay
• DNS prefetching, WebAuthn origin requests, and WebTransport bypass proxy settings, exposing users across all Apple browsers
• Tor and Psylo browsers issued fixes; Apple has not confirmed a patch but is reviewing the report

WebKit, Apple’s engine that powers all web browsers in its ecosystem, contained multiple flaws that helped leak the IP addresses of users who paid to keep them hidden.