Apple iCloud Private Relay Can Expose Real IPs via WebKit Proxy Bypass
What Happened — Researchers identified a flaw in Apple’s iCloud Private Relay that allows WebKit‑based browsers to bypass the dual‑hop proxy and reveal the user’s true IP address. The issue stems from a proxy‑bypass technique that can be triggered from malicious web content.
Why It Matters for Compliance & Audit Readiness
- The exposure defeats the privacy controls that iCloud Private Relay is marketed to provide, highlighting the need for continuous verification of privacy‑by‑design implementations.
- SOC 2’s CC2 – Confidentiality and CC6 – Privacy criteria require documented evidence that data‑masking or anonymization controls are effective; a hidden bypass undermines that evidence.
- Verisq’s CookiePLUS privacy capability helps organizations map consent, DSAR readiness, and IP‑masking controls to audit artifacts, providing a defensible trail when a privacy control is challenged.
Who Is Affected — Consumer‑facing technology platforms, SaaS browsers, and any organization that relies on iCloud Private Relay for user privacy (e.g., education, media, and enterprise BYOD programs).
Recommended Actions
- Review and update your privacy‑impact assessments to include proxy‑bypass testing.
- Map the Private Relay control to SOC 2 CC2/CC6 requirements and collect evidence of mitigation (e.g., patch status, configuration validation).
- Deploy continuous monitoring of WebKit‑based traffic to detect anomalous IP‑leak patterns. Source: The Hacker News
Technical Notes
- Attack vector: WebKit proxy bypass that forces traffic to skip the second relay hop, revealing the originating IP.
- No public CVE assigned yet; researchers have disclosed proof‑of‑concept code.
- Data exposed: user IP address (potentially correlated with browsing activity). Source: The Hacker News