ICloud Private Relay Can Leak Real IP Addresses via WebKit Passkey and WebTransport Vectors

Researchers Talal Haj Bakry and Tommy Mysk found two WebKit vectors that bypass Apple's iCloud Private Relay, exposing users' real IP addresses. Passkey authentication requests and WebTransport connections both operate outside Private Relay's Safari-scoped proxy path. 404 Media independently verified the findings. Apple says it is investigating.