Apple Patches Hide My Email Flaw More Than a Year After It Was Reported

Apple addressed a vulnerability successful Hide My Email that exposed a user's existent email address, reports 404 Media. Apple told the tract the contented was afloat fixed successful a spot released connected July 3.


The Hide My Email vulnerability was brought to Apple's attraction successful June 2025, but the institution did not hole it until 404 Media publicized the bug successful aboriginal July.

EasyOptOuts co-founder Tyler Murphy, who archetypal reported the flaw to Apple, said helium was told it was nether investigation. Apple told him the vulnerability was fixed successful March 2026, but it had not been. In the pursuing months, Apple said it was again looking into the problem, but Murphy was unconvinced Apple would really code it, truthful helium contacted 404 Media to marque it public.

404 Media confirmed the vulnerability has been patched, and has present shared details connected however it worked, since it tin nary longer beryllium exploited. Hide My Email is simply a paid iCloud+ diagnostic that lets users make an anonymous email code for website sign-ups and email correspondence.

Sending a targeted Hide My Email idiosyncratic a connection that got rejected arsenic spam caused the person's existent email code to look successful email logs.
"We don't cognize however often hidden email addresses were leaked successful email logs. For galore large email hosts, the leak was triggered simply by an email being automatically rejected arsenic spam, adjacent if it was a morganatic message. Such emails astir apt didn't marque it to your inbox, truthful you can't reappraisal your spam folder to larn whether you were affected," Murphy and EasyOptOuts co-founder Ben Weiner said successful a caller statement.

"The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't deliberation the hazard to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and due to the fact that message transportation logs are often retained, we'd presume that immoderate hidden email code linked to a Hide My Email code created earlier July 7, 2026, whitethorn person been exposed and could inactive beryllium successful third-party logs," they added.
While the bug has present been addressed, email logs that pre-date the hole could inactive exposure idiosyncratic email addresses.

Apple has been sued implicit the Hide My Email flaw, and the plaintiffs are seeking people enactment status. The suit says Apple violated California's mendacious advertizing instrumentality and different user extortion statutes due to the fact that Apple knew Hide My Email did not enactment arsenic advertised.
This article, "Apple Patches Hide My Email Flaw More Than a Year After It Was Reported" archetypal appeared connected MacRumors.com

Discuss this article successful our forums