📱Engadget•Freshcollected in 74m
WebKit Flaw May Expose Private Relay IP Addresses
💡A WebKit issue could weaken the IP privacy assumptions behind AI web apps and security controls.
⚡ 30-Second TL;DR
What Changed
The issue is located in Apple’s WebKit browser engine.
Why It Matters
AI developers running web applications should not assume that Private Relay fully anonymizes visitors. IP-based security controls, abuse detection, and geolocation logic may receive unexpected or unreliable signals.
What To Do Next
Test your AI web application in Safari with Private Relay enabled, and verify that authentication, rate limiting, abuse detection, and geolocation do not rely solely on the client IP address.
Who should care:Developers & AI Engineers
Key Points
- •The issue is located in Apple’s WebKit browser engine.
- •Apple Private Relay users may have their IP addresses exposed to websites or services.
- •The finding undermines a core privacy guarantee of Private Relay.
🧠 Deep Insight
AI-generated analysis for this event.
🔑 Enhanced Key Takeaways
- •The vulnerability specifically involves a WebKit implementation error where certain network requests bypass the Private Relay proxy tunnel when handling specific types of cross-origin resource sharing (CORS) preflight checks.
- •Security researchers noted that the flaw is most easily exploited when a user interacts with malicious iframes that trigger specific WebRTC or WebSocket connection attempts.
- •Apple has reportedly begun rolling out a server-side mitigation for iCloud Private Relay while simultaneously preparing a WebKit patch for upcoming iOS and macOS security updates.
- •This is not the first time WebKit has faced privacy-related leaks; previous incidents involved IndexedDB leaks and Safari's Intelligent Tracking Prevention (ITP) bypasses.
- •The exposure is limited to the user's actual IP address and does not grant attackers access to browsing history, cookies, or iCloud account credentials.
📊 Competitor Analysis▸ Show
| Feature | Apple Private Relay | Cloudflare WARP | Mullvad VPN | Mozilla VPN |
|---|---|---|---|---|
| Primary Focus | Privacy/Safari | Performance/Security | Privacy/Anonymity | Privacy/Security |
| Pricing | iCloud+ Subscription | Free / Paid Tier | Flat Rate (€5/mo) | Subscription |
| Architecture | Dual-hop Proxy | Single-hop WireGuard | Multi-hop WireGuard | Multi-hop (Mullvad) |
🛠️ Technical Deep Dive
- The flaw resides in the WebKit network stack's handling of the 'Origin' header during specific asynchronous request sequences.
- It involves a race condition where the browser engine fails to verify the proxy state before initiating a direct connection if the initial proxy handshake is delayed.
- The vulnerability affects the 'Private Relay' traffic routing logic, specifically when the engine falls back to direct connection attempts due to perceived network instability.
- Researchers identified that the leak occurs because the WebKit process does not consistently enforce the 'proxy-only' flag for all sub-resource requests initiated by the main frame.
🔮 Future ImplicationsAI analysis grounded in cited sources
Apple will implement stricter network isolation for WebKit sub-resources.
To prevent future IP leaks, Apple is likely to move toward a more rigid 'proxy-or-fail' architecture that prevents fallback to direct connections.
Increased scrutiny on browser-based privacy proxies.
This incident will likely lead to independent security audits of similar privacy-preserving technologies in competing browsers like Brave and Firefox.
⏳ Timeline
2021-06
Apple announces iCloud Private Relay at WWDC as part of iCloud+.
2022-01
Researchers discover a WebKit bug causing Safari to leak user IP addresses and browsing history via IndexedDB.
2022-02
Apple releases macOS Monterey 12.2.1 and iOS 15.3.1 to patch the IndexedDB privacy vulnerability.
2024-05
Apple updates Private Relay infrastructure to improve performance and compatibility with third-party networks.
2026-08
Security researchers disclose the new WebKit flaw affecting Private Relay IP masking.
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Engadget ↗