Persistent Vulnerability Detected
A privacy feature on Apple devices, Hide My Email,failed to conceal users' actual email addresses for over a year. The vulnerability allowed real addresses to be exposed through bounced spam messages. Apple has now confirmed a fix for this significant privacy lapse.
Breaking news
Echo Software Acquires Minimus Assets to Strengthen AI‑Driven Container Security
Plaud One Redefines Headphones for AI Note‑Taking
Apple Event Logo Suggests iPhone 18 Pro May Feature New Colors and Camera Upgrade
Plaud unveils smart earbuds that capture audio and execute tasks automaticallyThe Hide My Emailfunction is designed to create unique, random email addresses. These addresses forward messages to a user's primary inbox, protecting their true identity. However, this system was found to be compromised.
Security researcher Tyler Murphy first reported the flaw in June 2025. Apple initially stated the issue was resolved by March 2026. Despite this assurance, independent testing revealed the vulnerability persisted. It remained exploitable until at least July 3, 2026, when Apple finally deployed an effective fix.
How Did This Affect Users?
The problem arose when a spam message sent to a Hide My Emailaddress bounced. Instead of the bounce notification returning to Apple's proxy, it sometimes went directly to the user's real email address. This exposed the user's primary contact information to spammers. The flaw essentially defeated the purpose of the privacy feature.
Users who relied on Hide My Emailfor privacy could have had their real email addresses revealed. This increased their risk of receiving direct spam and unwanted communications. The feature's intended security was undermined by this technical oversight.
Apple's delayed resolution meant users were unknowingly vulnerable for an extended period. The company's commitment to user privacy was called into question by the lingering nature of the bug. This incident highlights the challenges of maintaining robust privacy features in complex systems.
Frequently Asked Questions
What is the Hide My Emailfeature? It's an Apple service that generates unique, random email addresses. These addresses forward to your real inbox, protecting your primary email from being directly exposed.
How did the bug expose real email addresses? When a spam message sent to a Hide My Emailaddress bounced, the bounce notification sometimes went to the user's actual email. This bypassed the privacy protection.
When was the bug finally fixed? Apple confirmed the bug was fully resolved by July 3, 2026, after an initial, ineffective fix was deployed in March 2026.
