CVE-2026-65355 in iOS
Summary
by MITRE • 09/15/2026
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability described constitutes an information disclosure flaw within the networking stack of Apple operating systems, specifically affecting iOS, iPadOS, macOS Tahoe, and visionOS. The core technical issue stems from inadequate state management during the handling of network requests when Apple's Private Relay feature is active. Private Relay is designed to enhance user privacy by encrypting internet traffic and routing it through a two-hop system that masks the user's IP address from destination websites. However, due to improper state tracking or synchronization errors within the underlying networking framework, certain web-based interactions can bypass these protections. This allows external entities to extract sensitive network identifiers that are supposed to be anonymized by the privacy feature.
From a technical perspective, this flaw represents a failure in enforcing isolation boundaries between user identity and application-level data transmission. When Private Relay is enabled, the operating system should consistently substitute the device's real IP address with an ephemeral one provided by Apple’s relay infrastructure throughout all network transactions initiated by web browsers or compatible applications. The defect indicates that under specific conditions, likely involving particular HTTP headers, connection states, or timing sequences, the system reverts to exposing the actual originating IP address. This breaks the fundamental promise of the privacy feature and creates a direct channel for fingerprinting users based on their geographic location and network provider, which are directly derivable from an IP address.
The operational impact of this vulnerability is significant in terms of user privacy and security posture. An attacker or malicious website can exploit this flaw to perform precise geolocation tracking and persistent identification of the device owner without requiring any additional permissions or exploits beyond standard web browsing interactions. This undermines trust in Apple’s privacy-centric features and exposes users to potential surveillance, targeted advertising based on location data, and potentially more sophisticated attacks that rely on IP-based reputation systems or rate limiting bypasses. For enterprise environments relying on these devices for secure communications, such leaks can compromise the anonymity of sensitive operations conducted over public networks.
This issue aligns with CWE-200, which classifies Information Exposure as a category where security-sensitive information is disclosed to unauthorized actors without explicit intent. It also relates to ATT&CK technique T1593, specifically Gather Victim IP Address, as it enables an adversary to collect network infrastructure details about the victim system. The root cause lies in CWE-20, Improper Input Validation or State Management errors where the application fails to maintain consistent security states across different operational phases of a connection.
Mitigation for this vulnerability requires immediate software updates to the specified versions: iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, or visionOS 26.6.1. These updates contain the necessary patches to correct the state management logic within the networking stack, ensuring that Private Relay functions as intended by consistently masking IP addresses regardless of the request context. Users and administrators should verify that all devices are updated to these versions before resuming activities where privacy is a critical concern. Additionally, while software remediation is primary, users can supplement this protection by employing additional network-level security measures such as DNS-over-HTTPS or dedicated VPN services with strict no-log policies, although reliance on OS-level fixes remains the most effective defense against this specific implementation flaw.