Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
Security Alert: Apple 'Hide My Email' Privacy Breach
Overview of the Vulnerability
The iCloud+ feature known as Hide My Email is designed to safeguard the privacy of users globally. Its primary purpose is to allow individuals to communicate and register for services without exposing their permanent, personal email addresses.
How it Should Work
The service functions as a proxy, generating a unique, randomized address that forwards mail to the user's actual inbox.
| Address Type | Example Format | Purpose |
|---|---|---|
| Proxy Address | random.email.22@icloud.com | Public-facing intermediary |
| Real Address | realname@example.com | Private, permanent destination |
Mathematically, the service is intended to be a one-way function where:
...but the inverse should be computationally impossible strictly prohibited.
The Discovery
Researchers have uncovered critical flaws in this system. These vulnerabilities allow a malicious actor to "unmask" a user, effectively discovering the private email address that was meant to remain hidden.
"We're publicly disclosing the existence of the vulnerability now because we think Hide My Email users deserve to know that their email addresses may not actually be hidden."
The authors emphasize that this disclosure is necessary so users can perform a proper risk assessment when deciding whether to trust the service with their anonymity. Special thanks are given to Joseph Cox of 404 Media, who served as a trusted third party for verification and responsible publicity.
Conceptual Flow of the Attack
Timeline of Events
The struggle to get this issue resolved has spanned over a year.
- June 11, 2025: Initial discovery and report sent to Apple.
- Apple's Response: They confirmed the service is
not intended by design to allow discovery of the hidden address.
- Apple's Response: They confirmed the service is
- June 13, 2025: A comprehensive report including reproduction steps was provided.
- June 20, 2025: Additional troubleshooting data submitted.
- July 9, 2025: A second, distinct vulnerability with the same result was reported.
- July 14, 2025: Apple acknowledged the reports were under review.
- March 3, 2026: Apple claimed the bugs were patched and requested verification.
- March 19, 2026: Verification failed; the original reproduction steps still worked.
- May 22, 2026: Researchers discovered the scope and severity were higher than previously estimated and updated Apple.
- June 30, 2026: Apple again claimed the issues were resolved.
Current Status & Recommendations
To prevent active exploitation, the specific technical details of the exploit are being withheld. However, the researchers have proposed a set of urgent actions for Apple:
Apple's Pending "To-Do" List
- Fully resolve the underlying vulnerabilities.
- Limit the attack surface (e.g., disable the creation of new proxy addresses).
- Send a formal notification to all affected
Hide My Emailusers. - Establish a more transparent and collaborative relationship with the researchers.
Technical Summary
The vulnerability can be conceptualized as a failure in the mapping logic:
def resolve_email(proxy_address):
# EXPECTED: Return encrypted/hidden token
# ACTUAL: Returns real_user_email due to vulnerability
return leaked_real_address
The researchers remain hopeful that Apple will act swiftly to protect user privacy.