iCloud Private Relay leaks real IPs via passkey requests
Security researchers found that Apple’s iCloud Private Relay, meant to mask Safari traffic, can be bypassed when a site triggers a passkey (WebAuthn) request, leaking the user’s true IP address. The flaw also affects Onion Browser, exposing users to location tracking and profiling.