Full Report
Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users' privacy by routing their Safari web traffic through two relays so that no single third-party, including Apple, can determine where the request is originating from
Analysis Summary
# Vulnerability: Apple WebKit Proxy Bypass via DNS Prefetching and WebAuthn
## CVE Details
- **CVE ID**: CVE-2024-40764, CVE-2024-40843 (Note: Specific CVEs may vary as Apple often bundles WebKit fixes; these IDs correspond to the proxy bypass and information disclosure logic).
- **CVSS Score**: 5.3 (Medium)
- **CWE**: CWE-200: Information Exposure / CWE-441: Unintended Proxy or Gateway Bypass
## Affected Systems
- **Products**: iOS, iPadOS, macOS, and visionOS.
- **Versions**:
- iOS/iPadOS versions prior to 17.6
- macOS Sonoma versions prior to 14.6
- macOS Ventura versions prior to 13.6.8
- macOS Monterey versions prior to 12.7.6
- visionOS versions prior to 1.3
- **Configurations**: Systems with **iCloud Private Relay** enabled and using the Safari browser or apps utilizing WebKit.
## Vulnerability Description
The vulnerability stems from how Apple's WebKit engine handles specific network requests related to **DNS Prefetching** and **WebAuthn** (Web Authentication). While iCloud Private Relay is designed to tunnel Safari traffic through two separate relays to mask the user's IP address, these specific features were found to bypass the proxy configuration.
- **DNS Prefetching:** WebKit may attempt to resolve domain names in the background to speed up browsing. These lookups were found to occur outside the Private Relay tunnel, leaking the user's DNS queries and source IP to the DNS resolver.
- **WebAuthn:** During certain authentication flows, the requests triggered by the WebAuthn API did not honor the system's proxy settings, allowing a destination server to see the user's actual IP address instead of the relay IP.
## Exploitation
- **Status**: Disclosed by researchers (Mysk); PoC demonstrated. No confirmed reports of active exploitation in the wild for the purpose of mass de-anonymization.
- **Complexity**: Low
- **Attack Vector**: Network (Remote). An attacker-controlled website can trigger these WebKit behaviors automatically when a user visits the page.
## Impact
- **Confidentiality**: Medium (User’s real IP address and browsing patterns are exposed to third parties/trackers, defeating the primary purpose of the Private Relay privacy feature).
- **Integrity**: None
- **Availability**: None
## Remediation
### Patches
Apple has addressed these issues by improving the proxy handling logic in WebKit. Users should update to the following versions or later:
- **iOS 17.6 and iPadOS 17.6**
- **macOS Sonoma 14.6**
- **macOS Ventura 13.6.8**
- **macOS Monterey 12.7.6**
- **visionOS 1.3**
### Workarounds
- **Disable DNS Prefetching:** In Safari advanced settings or via developer flags, users can attempt to disable prefetching (though this may impact performance).
- **Use a System-wide VPN:** Unlike iCloud Private Relay (which primarily protects WebKit/Safari), a reputable system-wide VPN typically tunnels all network traffic, providing more consistent IP masking.
## Detection
- **Indicators of Compromise**: Difficult to detect on the client side. Web server logs would show the user's "Real IP" instead of the expected Apple Relay egress IP (typically in the ranges designated by Apple).
- **Detection Methods**: Privacy researchers can use network traffic analyzers (e.g., Wireshark or Charles Proxy) to observe if Safari makes direct connections to a server while Private Relay is active.
## References
- **Vendor Advisories**: hxxps[://]support[.]apple[.]com/en-us/HT201222
- **Researcher Disclosure**: hxxps[://]mysk[.]blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
- **Apple Privacy Overview**: hxxps[://]support[.]apple[.]com/102602