A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.

The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products. Last month 404 Media reported a bug in Apple’s Hide My Email feature was actually revealing peoples’ real email addresses. Apple knew about that issue for more than a year before fixing it.