Apple’s Private Relay, intended to shield users' IP addresses while browsing the internet with Safari, has a major flaw. Researchers have discovered that it can reveal real IP addresses due to vulnerabilities in Apple’s WebKit browser engine.

The issue was first brought to light by 404 Media and is part of a larger problem affecting all browsers on iOS, not just Private Relay. The researchers note that Private Relay only works with Safari and does not function as a full Virtual Private Network (VPN), which provides protection at the system level.

Testing conducted by TechCrunch verified that even though users are supposed to remain anonymous through Private Relay, their real IP addresses can still be exposed on this newly discovered site. This revelation is particularly concerning for iCloud+ subscribers who rely on Private Relay’s privacy features.

The researchers, Talal Haj Bakry and Tommy Mysk, chose not to report the issue directly to Apple due to past experiences with the company's handling of such matters. Apple did not respond immediately to requests for comment.

Meanwhile, Psylo, a private browser developed by Mysk and colleagues, now includes mitigations against IP address leaks, suggesting that users should consider alternatives if they need robust privacy protection.