Apple's iCloud Private Relay, introduced with iOS 15, relies on a proxy server to route Safari web traffic through two relays. This dual-hop approach is intended to conceal users' IP addresses from third-party trackers. However, researchers have found that this mechanism can be exploited to reveal a user's real IP address.
According to the researchers, the flaw arises from a vulnerability in the WebKit engine, which powers Safari on iOS devices. By manipulating the WebKit proxy, an attacker can bypass the relay's protection and obtain the user's real IP address.
Apple has acknowledged the issue and is working to resolve it. In the meantime, users are advised to take precautions to protect their online privacy.