Apple’s Hide My Email feature has an unfixed bug that leaves email addresses exposed


Apple has been selling Hide My Email to keep your real email address hidden, but it has a vulnerability that does the exact opposite. The worst part is that the company has known about it for a year. 

Hide My Email, part of Apple’s paid iCloud+ subscription, lets users generate anonymous email addresses for signing up to a website, so that their personal or work email remains free of promotional emails and spam. 

However, the team at 404 Media, along with a security researcher, has now confirmed that the feature has a bug that links those anonymous addresses back to your real Apple ID email.

So what exactly happened here?

Tyler Murphy, co-founder of privacy tool EasyOptOuts, reported the vulnerability to Apple in June 2025. Apple acknowledged it a month later and was looking into the issue. 

Then, in March 2026, Apple told Murphy the problem had been addressed in an update, which usually means that it has been fixed. To verify, Murphy tested it again and found the issue was still present, providing Apple with more information. 

As recently as May 2026, Apple told Murphy it was still investigating and asked him not to go public with the information. The company also said a fix was expected “in the coming weeks,” which still hasn’t arrived.

To verify independently, 404 Media verified the issue this week by generating a new Hide My Email address and providing it to Murphy. About five minutes later, Murphy returned the real email address associated with that Apple account.

What does this mean for users?

In Murphy’s own limited tests, 100% of Hide My Email addresses were exploitable. 

Since people-search websites can link an email address to a name, location, and other personal details, anyone using Hide My Email for safety could be at risk. 

The outlet has not published the technical details of the exploit since it remains active. 

Hide My Email is also set to become much less effective, but for a totally different reason. A separate report from June 2026 revealed Apple’s plans to shift generated email addresses from the icloud.com domain to private.icloud.com.

This would make it easier for websites and services to identify and block them, effectively reducing its usefulness for avoiding spam and unwanted tracking.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


One of the worst things about the explosion of AI tools is how much more advanced scam calls have become. It’s now entirely possible to get fake calls with voices that sound exactly like people you know. The June Android drop is here to address this (and add some other goodies).

Fake Call Detection

When scammers impersonate your contacts

1. Call spoofing diagram Credit: Google

The aforementioned voice duping is only one part of the scamming process. If the call comes from an unknown number, you’re far more likely to ignore it. That’s why scammers can also make their calls appear to be coming from numbers you trust.

Fake Call Detection is a new feature in the Phone by Google app that pops up an alert when a caller is suspected of impersonating your contacts. The alert says, “This may not be [Name]” and gives you the option to immediately hang up.

Google Photos is your new wardrobe

Digitally store and try on clothes

You may not know it, but there’s an entire category of apps dedicated to allowing people to catalog their wardrobes. Now, Google Photos is hoping to get in on it with a new “Wardrobe” collection.

First, you snap photos of your clothes and let Google Photos neatly put them on a white background. From there, everything can be categorized by item. You can then tap “Create” and put outfits together, which you can digitally try on. It’s a pretty cool feature that many apps charge a fee for.


Personal safety features expand to kids

13 and under

Google is making the Personal Safety app for Pixel phones available to kids under 13. Features include the ability to display medical information, setting emergency contacts on the lock screen, and car crash detection. In addition, kids over 13 can now use Safety Check and real-time sharing with emergency contacts.

“Catch me up” in Google Play Books

Recaps of what you’ve read

Remember Google Play Books? The company’s often overlooked eBook platform is getting a new feature to help you catch up when you haven’t read a book in a while. It works pretty much how you’d expect—AI summarizes what’s happened up until your current position in the book. It’s also possible to highlight text and ask questions about what you’re reading. These features are part of the new “Book Insights” button.

Quick Share 🤝 AirDrop

Now works with more devices

Last year, Google announced that the Pixel 10 series could share content with Apple’s AirDrop through Quick Share. Since then, it has very slowly expanded the functionality to more phones. Now, once again, the company is announcing even more devices.

The previous list was the Pixel 10 series, Galaxy S26 series, Oppo Find X9 series, Find N6, and Vivo X300 Ultra. New entries include the Galaxy S25 series, S24 series, Z Flip 7, Z Fold 7, Z Flip 6, Z Fold 6, Z TriFold, OPPO Find X8 series, OnePlus 15, HONOR Magic V6, and Magic8 Pro.

Keep your eyes peeled for these features to be rolling out to Android devices and the accompanying apps over the next few days and weeks.

Source: Google



Source link