CVE-2026-65352 in iOS
Summary
by MITRE • 09/15/2026
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability described constitutes an information disclosure flaw within Apple’s networking stack, specifically affecting the implementation of Private Relay across iOS, iPadOS, macOS Tahoe, and visionOS platforms. This issue arises from inadequate state management during the process of routing internet traffic through Apple’s private relay infrastructure. When a user enables Private Relay, their network requests are intended to be anonymized by being routed through an intermediate proxy server before reaching the destination website. The design goal is to prevent websites from directly observing the user's original IP address, thereby preserving privacy and preventing location tracking based on network origin. However, due to improper handling of connection states or session identifiers during this routing process, a maliciously crafted website can exploit specific timing conditions or state inconsistencies to bypass these protections.
From a technical perspective, the core flaw lies in how the operating system manages the transition between direct connections and relayed connections. The vulnerability allows an attacker-controlled webpage to determine the user's true IP address despite Private Relay being active. This typically occurs when the browser or network stack fails to properly isolate the identity of the client during specific handshake phases or DNS resolution steps that are not fully encapsulated by the relay mechanism. By analyzing response times, connection errors, or other side-channel information derived from these state management failures, an adversary can correlate the request with the user's actual public IP address. This represents a significant deviation from the expected privacy guarantees provided by the Private Relay feature, effectively nullifying its primary function for affected users during specific interactions.
The operational impact of this vulnerability is substantial regarding user privacy and security posture. An attacker who successfully exploits this flaw can perform precise geolocation tracking, bypassing the anonymization layer that Apple provides to protect against surveillance and profiling. This capability enables targeted phishing campaigns where the attacker tailors content based on the victim's real-world location or ISP details. Furthermore, it facilitates persistent fingerprinting across sessions if combined with other techniques, as the IP address serves as a strong identifier for device correlation. For enterprise environments relying on these devices for secure communications, this flaw undermines trust in built-in privacy features and may expose sensitive organizational traffic patterns to external observers who can infer internal network structures or employee locations based on leaked IP data.
This vulnerability aligns with CWE-200, which defines Information Exposure, specifically falling under categories related to exposure of sensitive information through improper state handling or side-channel leaks. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Reconnaissance and Collection, particularly those involving network-based discovery where an adversary gathers intelligence about a target's environment without direct interaction that would trigger alarms. The exploitation relies on passive observation rather than active intrusion, making it difficult to detect through traditional endpoint security monitoring tools.
Mitigation for this issue is primarily addressed through software updates provided by Apple. Users must update their devices to iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, or visionOS 26.6.1 to receive the patched state management logic that correctly isolates user identity during relay operations. Until these updates are applied, users should exercise caution when visiting untrusted websites while relying on Private Relay for anonymity. Additionally, employing additional privacy-focused browser extensions or using Tor-based browsing can provide supplementary layers of protection against IP leakage in environments where immediate patching is not feasible. Security administrators should ensure that device management policies enforce automatic OS updates to minimize the window of exposure for this class of vulnerabilities across their fleets.