If you pay for iCloud+ and switch on Private Relay, you probably assume the websites you visit cannot see where you really are. New research says that assumption does not always hold, and the gap shows up during something Malaysians do dozens of times a day: signing in.
Security researchers Tommy Mysk and Talal Haj Bakry found that Apple's Private Relay, the iCloud+ feature meant to hide your IP address in Safari, can be bypassed by any website that supports passkeys, the newer password-free sign-in method. As TechCrunch reported, the passkey request is handled by the operating system's credential service rather than by Safari, so it never travels through Private Relay's protected path. The site you are logging into sees your real IP address either way.
Editor
Dinesh Raj chevron_right
Table of Contents
It is not only passkeys
The same researchers flagged two more leaks in Apple's WebKit engine. DNS prefetching, added in iOS 26, can reveal the DNS servers you actually use, and WebTransport, added in iOS 26.4, can expose your IP address during certain connections. None of these require you to turn Private Relay off. They slip around it while it is still switched on. Mysk has filed a report with Apple, which says a fix is planned for later in 2026, and the researchers have set up a page where anyone can test whether their own IP leaks.
Why this matters in Malaysia
This is not a niche problem here. Apple's iOS now runs on close to half of all phones in Malaysia, at about 45 percent against Android's 55 percent, according to Statcounter's Malaysia data. A large share of those users pay for iCloud+ storage, which quietly bundles Private Relay, and many switch it on precisely because they want one less party tracking them. Passkeys are also being pushed hard by banks and platforms here as the safer replacement for passwords, which means the exact feature Malaysians are being told to adopt is the one that trips this leak.
The practical risk is modest for most people. An exposed IP address is not your name or your bank details, and Private Relay was always a privacy convenience rather than a full shield like a VPN. But it does undercut the specific promise Apple makes for the feature, and it is a useful reminder that a privacy toggle is only as good as the paths it actually covers. We have written before about how much iPhone activity now leaves the device, from Siri leaning on cloud models to answer questions, and about the wider fight over encryption and privacy that Malaysian users are caught in.
What to do for now
There is no setting that closes the gap today, so the honest answer is to keep your iPhone updated and install Apple's fix when it lands. If hiding your IP genuinely matters for your work, a reputable VPN still does what Private Relay cannot. And if you are curious, the researchers' checker will show you in seconds whether your real address is leaking right now.
Private Relay is not broken, but it is narrower than the marketing suggests. Knowing where it stops is the whole point.
Images courtesy of Bagus Hernawan, Swello and Muhammad Haikal Sjukri on Unsplash.
