Your iPhone Is Sharing More Than You Think: The iCloud Private Relay Crack

Key takeaways

• Researchers Tommy Mysk and Talal Haj Bakry identified that Passkeys and WebAuthn requests can bypass iCloud Private Relay, exposing user IP addresses.
• Specific OS-level features like DNS prefetching in iOS 26 and WebTransport in iOS 26.4 are identified as current leak paths.
• Unlike a system-wide VPN, Private Relay only protects Safari and specific DNS traffic, creating privacy gaps that Android's full-system VPN approach often avoids.

The Illusion of the Digital Ghost

Imagine walking through a crowded city in a perfect disguise, only to realize your name tag is still pinned to your back. For millions of iPhone users, a similar reality is setting in today. Apple has long positioned itself as the fortress of digital privacy, with iCloud Private Relay serving as the primary moat. However, new technical revelations suggest that the moat might have a few hidden bridges that data trackers are more than happy to cross. This is not just a minor bug; it is a fundamental reminder that even in the walled garden, total anonymity is often an aspiration rather than a reality.

The Leak in the Armor

The controversy stems from a series of reports by researchers Tommy Mysk and Talal Haj Bakry, which have been widely detailed by MacRumors and Macworld this week. The researchers discovered that even when iCloud Private Relay is active, certain web features can still broadcast a user's real IP address to the world. The primary culprit involves Passkeys and WebAuthn requests. Because these requests are handled by the core operating system credential service rather than the Safari browser itself, they frequently bypass the proxy path of Private Relay. When you go to log in with a passkey, your device might be handing over your digital home address without you ever knowing it.

This is not the only vulnerability found in the current software cycle. According to findings published by TechCrunch, specific features within iOS 26 and iOS 26.4 are also showing cracks. DNS prefetching in iOS 26 can reveal a user's DNS servers, while a protocol known as WebTransport can expose an IP address even while a user is browsing in what they believe is a protected state. While Apple has built a sophisticated system of dual relays to hide user traffic, these edge cases show that the boundaries of protection are narrower than the average consumer assumes.

Context Box: What Is iCloud Private Relay?

Launched as a centerpiece of the iCloud+ subscription, Private Relay is a privacy service that ensures the traffic leaving your iPhone is encrypted and sent through two separate internet relays. The first relay knows your IP but not the site you are visiting; the second knows the site but not your IP. It is designed specifically for Safari and DNS traffic, but notably, it is not a system-wide VPN. This distinction is critical for users to understand, as apps and specific system services often operate outside this protected tunnel.

iPhone vs. Android: The Privacy Architecture War

This revelation reignites the long-standing rivalry between Apple and the Android ecosystem regarding how privacy should be handled. On the Android side, Google has focused heavily on giving users the ability to use full-system VPNs, such as the VPN by Google One (which was recently integrated into the core system settings for Pixel devices). Because a traditional VPN creates an encrypted tunnel for the entire device, it typically avoids the "leaky feature" problem that Private Relay faces. However, Android's open nature often means more data is harvested by third-party apps by default.

Apple's approach is more surgical. By focusing only on Safari, they maintain higher internet speeds and better app compatibility, but as Mysk and Bakry have shown, this surgical precision creates gaps. If you are an iPhone user, you are getting high-speed, integrated privacy that works 90 percent of the time. If you are a high-end Android user with a dedicated VPN, you might have more consistent cloaking at the cost of battery life and occasional app glitches. For the average student or professional, the choice comes down to whether you trust a single toggle or a dedicated security app.

Why It Matters

This development matters because it challenges the "set it and forget it" mentality of modern tech security. Many users enable Private Relay and believe they are invisible to advertisers and malicious actors. These leaks prove that metadata, such as your IP address and DNS queries, remain vulnerable. For activists, journalists, or anyone in a high-risk digital environment, relying solely on Private Relay could lead to a false sense of security. It highlights that in 2026, privacy is not a binary state (on or off) but a spectrum of risk management.

What to Watch Next

As the tech world looks toward the upcoming iPhone events teased by 9to5Mac, expect Apple to address these security concerns in the next iteration of iOS. We should watch for three specific things: first, whether Apple will expand Private Relay to cover all system-level WebKit requests; second, if they will introduce a "Lockdown Mode" update that forces all traffic through the relay regardless of the protocol; and third, how the company justifies these leaks in its upcoming marketing materials. Historically, Apple is quick to patch reported vulnerabilities, so a fix for the WebTransport and DNS prefetching leaks may be bundled into a late-August security update.

The Final Takeaway

The takeaway for every smartphone user is clear: your device is a tool of convenience, not a perfect shield. While iCloud Private Relay provides significantly better protection than browsing the open web on a standard connection, it is not a substitute for a dedicated, high-quality VPN if your goal is total anonymity. Use the tools provided, but stay informed about their limits. In the digital age, the most powerful security feature you own is your own awareness.