A newly disclosed vulnerability in Apple’s iCloud Private Relay allows a user’s true IP address to be exposed by exploiting how the WebKit rendering engine handles standard HTTP redirects. The issue, highlighted in a report from The Hacker News, reveals a significant gap between the theoretical privacy of the service’s design and its real-world implementation in Safari.
Launched with iOS 15, iCloud Private Relay aims to anonymize browsing by routing traffic through two separate relay servers, preventing any single entity—including Apple—from linking a user to their web activity. However, security researchers found that a common server-side redirect, specifically an HTTP 302 response, can cause WebKit to drop the second relay hop. This forces a direct connection to the destination server, bypassing the privacy layer and leaking the device’s network address.
The discovery underscores a persistent challenge in privacy technology: even well-designed systems can be undermined by foundational web protocols. While the dual-hop architecture remains sound in theory, the implementation in WebKit introduced an unforeseen attack surface through routine redirect functionality. This case emphasizes the need for rigorous security testing that examines the entire software stack, not just isolated components like cryptographic or routing protocols.
For organizations and IT teams, the flaw serves as a reminder that consumer-grade privacy tools should not be relied upon as standalone solutions. iCloud Private Relay should be viewed as a supplementary layer within a broader security strategy. Users handling sensitive data in Safari are advised to combine it with additional network-level controls, such as reputable VPNs, to maintain confidentiality. The incident also reinforces calls from the security community for ongoing, independent audits of proprietary privacy implementations, which are crucial for uncovering such edge-case vulnerabilities.
As of the initial disclosure, Apple has not issued a detailed technical advisory or mitigation timeline for affected users. Unanswered questions remain about whether similar redirect-based bypasses could impact other parts of the Apple ecosystem or non-Safari traffic routed through the relay infrastructure. In the meantime, experts recommend caution when using Safari for sensitive activities with Private Relay active, supplementing it with stronger privacy measures.
This vulnerability illustrates the inherent tension between seamless web functionality and robust privacy protections. As major platforms integrate advanced anonymity features, independent researcher scrutiny will continue to be vital for verifying claims, driving improvements, and maintaining user trust.
近期披露的一個蘋果iCloud私密轉送（Private Relay）漏洞，透過利用WebKit渲染引擎處理標準HTTP重定向的方式，可能導致用戶的真實IP位址被曝光。據The Hacker News報導，此事揭示了該服務在理論私隱設計與Safari實際執行之間存在顯著落差。
iCloud私密轉送隨iOS 15推出，旨在透過將流量經由兩個獨立的中繼伺服器路由來實現匿名瀏覽，防止任何單一實體（包括蘋果）將用戶與其網絡活動連結。然而，安全研究人員發現，一種常見的伺服器端重定向——具體是HTTP 302回應——可能導致WebKit放棄第二層中繼跳轉。這迫使設備與目標伺服器建立直接連接，從而繞過私隱層，洩露設備的網絡位址。
這項發現突顯了私隱技術領域一項持續存在的挑戰：即使是設計良好的系統，也可能被基礎的網絡協議所削弱。雖然雙跳架構在理論上依然健全，但WebKit的實作卻透過常規的重定向功能引入了未預見的攻擊面。此案例強調了進行嚴格安全測試的必要性，測試範圍需涵蓋整個軟件堆疊，而非僅限於孤立組件（如加密或路由協議）。
對企業和IT團隊而言，此漏洞提醒我們，不應將消費級私隱工具視為獨立解決方案。iCloud私密轉送應被視為更廣泛安全策略中的補充層。建議在Safari中處理敏感數據的用戶，結合使用其他網絡層級控制措施（如信譽良好的VPN），以維持機密性。此次事件亦加強了安全界對持續、獨立審核專有私隱實作的呼籲，這對於發現這類邊緣案例漏洞至關重要。
截至初步披露時，蘋果尚未針對受影響用戶發布詳細的技術公告或修復時間表。目前仍有懸而未決的問題，例如類似的基於重定向的繞過方法是否會影響蘋果生態系統的其他部分，或經由私密轉送基礎設施路由的非Safari流量。同時，專家建議在使用Safari進行涉及敏感性的活動並啟用私密轉送時應保持謹慎，並輔以更強力的私隱措施。
此漏洞闡明了流暢網絡功能與強健私隱保護之間固有的張力。隨著主要平台整合先進的匿名功能，獨立研究人員的審查將持續對驗證聲明、推動改進以及維持用戶信任至關重要。