Apple's Hide My Email feature vulnerable; fix not effective
A vulnerability in Apple's Hide My Email service can expose users' real email addresses, and attempts to patch the flaw have not succeeded.
Apple’s Hide My Email feature has a vulnerability that can allow attackers to discover the real email address behind an anonymized alias, and the vulnerability remains unpatched. The bug was first flagged by researcher Tyler Murphy in June 2025, according to the Times of India. Hide My Email masks a user’s primary email address and replaces it with a randomly generated @icloud.com address, and emails sent to the random @icloud.com address are automatically forwarded to the user’s main email address, according to Tom's Guide.
Multiple news outlets reported that Apple’s fixes for the vulnerability have not stuck, indicating that the issue persists.
This account was written only from facts that survived Augur's
corroboration pass — 2 corroborated across opposed news blocs,
0 contested (attributed to both sides), 3
single-source (attributed). Nothing was added; no significance was inferred.
Model Qwen3-Next-80B-A3B-Instruct.
See the evidence & the verbatim quotes →