Fox News Flash top headlines are here. Check out what's clicking on FoxNews.com.
If you pay for iCloud+ and use Safari, you may have turned on iCloud Private Relay for an extra layer of privacy. Apple designed the feature to prevent websites from seeing your actual IP address and exact location.
Now, security researchers have found three ways that certain WebKit features can slip outside that protection.
Researchers Talal Haj Bakry and Tommy Mysk discovered that DNS prefetching, a WebAuthn feature connected to passkeys and WebTransport can bypass WebKit's proxy configuration. Two of those methods can expose your real internet protocol (IP) address. The other can reveal information about the DNS servers your device is using.
What makes this especially concerning is that these are legitimate browser technologies. A website does not necessarily need to convince you to download a suspicious file or install a shady app for the network requests to occur.
Here's how these iCloud Private Relay leaks work, who may be affected and what you can do to better protect your privacy.
New! Free live CyberGuy class: Protect Your Money From Today’s Biggest Threats
Join us Saturday, Aug. 29, at 10 a.m. ET for a free CyberGuy LIVE class covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt "CyberGuy" Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. You’ll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.
Reserve your free spot today at CyberGuyLive.com.
ARE APPLE DEVICES SPYING? WHAT YOUR IPHONE TRACKS
iCloud Private Relay is designed to hide your IP address in Safari, but researchers found WebKit paths that can bypass that protection. (Kurt "CyberGuy" Knutsson)
The design keeps any single party from seeing both who you are and which websites you visit. That makes Private Relay useful if you want to reduce the amount of location and browsing information websites can collect about you. However, the newly documented WebKit behavior creates paths around that relay.
The researchers identified three separate mechanisms. Each works a little differently.
Browsers often try to make websites load faster by looking up the addresses of links before you click them. This process is called DNS prefetching. Normally, you would expect those lookups to follow the same privacy path as the rest of your browsing.
The researchers found that WebKit can instead send these DNS requests through your device's normal DNS connection. As a result, a website could see DNS requests coming from your real network instead of the proxy. The issue has been available on iOS since iOS 26.0, according to the researchers.
