Observed Signal · Aug 5, 2026 · Security Vulnerability Disclosure · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
Apple Private Relay can leak real IP addresses
Researchers Talal Haj Bakry and Tommy Mysk disclosed vulnerabilities in Apple’s Private Relay that can be exploited to reveal users’ real IP addresses when browsing with Safari. The researchers published a blog post and a test site that TechCrunch verified can expose real IPs despite Private Relay being enabled. The root cause is attributed to three features in Apple’s WebKit browser engine used on iOS. Private Relay is an opt-in iCloud+ feature that operates only within Safari and is not a system-wide VPN. The researchers chose not to report the issue to Apple and say their Psylo browser includes mitigations.
A major platform (Apple) has a disclosed vulnerability in a privacy feature used by iCloud+ subscribers and iOS Safari; this affects browser-level privacy protections and has implications for identity, tracking, and industry trust.
Track Apple Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Researchers Talal Haj Bakry and Tommy Mysk published a blog post describing flaws that can reveal the real IP address of users using Apple Private Relay.
- The researchers set up a website where users can test whether their IP leaks; TechCrunch verified the site could reveal a real IP.
- The problem is attributed to three features in Apple’s WebKit browser engine, which is used by all browsers on iOS.
- Private Relay is an opt-in feature available to iCloud+ subscribers and only protects IPs while using Safari, not at the system level like a VPN.
Connected Companies & Entities
3 Entities mapped“Apple’s Private Relay, an opt-in feature designed to hide a user’s IP address when they browse the internet with Safari, can be circumvented...”
“In a test on Tuesday, TechCrunch verified that the site was able to reveal our real IP address....”
“The issue was first reported by 404 Media....”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Apple 'Hide My Email' Bug Reveals Real Addresses
A security researcher has reported a vulnerability in Apple’s 'Hide My Email' feature (part of iCloud+) that can reveal users’ actual email addresses behind one-time, randomly generated forwarding addresses. According to 404 Media, researcher Tyler Murphy of the data-deletion service Easyoptouts discovered the bug in June 2025 and notified Apple, but the company has not fixed the issue for about a year. 404 Media says it was able to reproduce the disclosure using the exploit supplied by Murphy. Both Murphy and 404 Media withheld technical details to avoid enabling abuse; Apple previously asked the researcher not to publish exploit details. The flaw raises privacy risks, including the ability to link masked addresses to personal data on public people-search sites.
Bug in Apple’s Hide My Email Exposes Real Addresses
New research reported by 404 Media and summarized by TechCrunch claims a vulnerability in Apple’s Hide My Email feature can reveal users’ real email addresses. Researcher Tyler Murphy, co‑founder of EasyOptOuts, says he informed Apple more than a year ago and that 404 Media tested and verified the issue; in limited volunteer tests Murphy reported 100% of Hide My Email addresses were exploitable. Details of the vulnerability have been withheld from public disclosure to avoid abuse. Murphy warned that people‑search and data broker sites can link exposed emails to additional personal information, increasing privacy risk. TechCrunch contacted Apple for comment. The report follows prior scrutiny of Apple privacy features in 2022 and 2023 for other perceived privacy failures.
Apple changes Sign in with Apple relay domain
On August 24, 2026, Apple announced that new Sign in with Apple relay email addresses previously issued on privaterelay.appleid.com will be issued on private.icloud.com starting later in 2026. Existing privaterelay.appleid.com addresses will continue to work and forward mail without interruption. Apple confirmed iCloud+ "Hide My Email" addresses will remain on icloud.com. Developers are instructed to update account systems, email validation logic, and allowlists to accept the new private.icloud.com domain in addition to the existing privaterelay.appleid.com addresses.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.