Affected Systems

Apple iCloud Private Relay on iOS 15+, macOS, and iPadOS. Affects Safari and all WebKit-based browsers (Chrome, Edge, Firefox, Brave) on Apple platforms. Impacts users with iCloud+ subscriptions using Private Relay for privacy protection.

Exploitation Status

Proof-of-concept publicly available at leaks.psylo[.]app. Exploitation requires deliberate website configuration to trigger WebKit features (DNS prefetching, WebAuthn Related Origin Requests, WebTransport) that bypass proxy. No user interaction required for WebAuthn-based leak.

Business Impact

Users relying on iCloud Private Relay for IP anonymization are exposed to tracking and deanonymization by any website exploiting WebKit's proxy bypass behaviors. Particularly concerning for organizations using passkeys (WebAuthn), as any site claiming WebAuthn support can silently harvest real IP addresses. VPN usage mitigates the leak. Apple is investigating but no patch timeline provided.

Urgency

🟡 Within a week

Recommended Actions

  • Test exposure using the PoC site leaks.psylo[.]app on managed Apple devices with Private Relay enabled
  • Deploy VPN solutions for users requiring IP anonymization, as VPNs mitigate the WebKit proxy bypass
  • Educate users that iCloud Private Relay currently cannot guarantee IP privacy on WebKit-based browsers
  • Monitor Apple security advisories for patches addressing WebKit DNS prefetching, WebAuthn, and WebTransport proxy bypass issues
  • Consider restricting WebAuthn/passkey usage on sensitive internal applications until Apple resolves the leak