AppleInsider reproduced Hide My Email address-exposure flaw two weeks after Apple's claimed July 3 fix
Apple claimed it patched a Hide My Email privacy flaw on July 3, but the bug was still reproducible on July 17.
A privacy flaw in Apple's Hide My Email service that can expose users' real email addresses behind their anonymous aliases was still working two weeks after Apple said it had fixed it. Apple told outlet 404 Media that it deployed a patch on July 3, 2026, and had fully resolved the vulnerability. AppleInsider then tested the flaw and successfully reproduced it on July 17 — 14 days after that claimed repair date. The vulnerability works by allowing a sender who already possesses a specific Hide My Email alias to reverse-engineer and reveal the real address linked to it, though AppleInsider noted the attack requires a meaningful degree of technical knowledge. Hide My Email is an Apple privacy feature, part of iCloud+, that generates random proxy email addresses to shield users' actual inboxes. AppleInsider has contacted Apple for comment on why the flaw remained exploitable after the stated patch date and said it will update its reporting when a response is received. The original disclosure of the vulnerability came through 404 Media.
Why it matters
Hide My Email is used by iCloud+ subscribers specifically to protect their real email addresses from exposure; a working bypass undermines that core privacy guarantee. If the flaw persists after a claimed fix, users who believe they are protected may remain at risk without knowing it.
What's next
AppleInsider is awaiting a response from Apple to explain why the flaw was still reproducible on July 17, two weeks after the claimed patch date.
Key facts
- Apple told 404 Media it patched the Hide My Email flaw on July 3, 2026, calling it fully resolved
- AppleInsider independently reproduced the vulnerability on July 17, 2026 — 14 days after Apple's claimed fix date
- The flaw allows a sender with a known Hide My Email alias to uncover the real email address behind it
- AppleInsider noted exploiting the flaw requires significant technical knowledge
- Hide My Email is an iCloud+ privacy feature that generates random proxy addresses to mask users' real inboxes
- AppleInsider has contacted Apple for comment and had not received a response at time of publication
Bias & framing notes
Only one source provided usable reporting (the bundle_app content was paywalled and unavailable). AppleInsider is both the reporter and the party that conducted the independent reproduction test, which is relevant context — their firsthand testing adds specificity but means there is no second independent outlet corroborating the July 17 reproduction result. The framing is notably critical of Apple, with no Apple response yet included to balance the account.
NewsClear — neutral news & congressional tracking · Bill of the Week