A researcher says a vulnerability in Apple's Hide My Email tool lets anyone see a user's real email address; first reported in June 2025, Apple has not fixed it
404 MediaJoseph Cox
Context & Ripple Effects
The related coverage places this report in a longer pattern of Apple privacy and email-related flaws that remained unresolved for a period after disclosure, including iOS Mail phishing and Safari URL-spoofing issues.
It also contrasts with a more recent case in which Apple eventually fixed a privacy leak involving Private Wi-Fi Address, making the outstanding Hide My Email report a test of how quickly a privacy feature is remediated once exposure is known.
First-order effects
People using Hide My Email may have the real address the feature is meant to mask exposed to third parties, weakening the protection for affected aliases.
Apple faces an unresolved disclosure around a privacy product, with no reported fix despite the issue having first been reported in June 2025.
Second-order effects
Users and organizations that treat email aliases as a barrier against unwanted contact may need to reassess whether those aliases can still be relied on for address separation.
The delay gives researchers and Apple’s privacy-focused competitors another concrete case for scrutinizing the gap between privacy-feature branding and vulnerability-response timelines.
Third-order effects
If privacy-layer vulnerabilities repeatedly remain open after disclosure, users may increasingly judge such features by remediation transparency and reliability rather than by their stated privacy design alone.
The broader pressure is toward privacy products being evaluated as security-critical infrastructure: their value depends not only on masking data, but on how quickly failures in that masking are identified and fixed.
The trend: This is part of a broader shift from privacy features as product differentiators to privacy guarantees that are judged by ongoing security maintenance and disclosure response.
“Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” the person who reported the issue said.
New: there is a major vulnerability with Apple's Hide My Email feature that lets attackers discover peoples' real emails. Verified it works on my own email. We're not disclosing how it works because Apple has not fixed it. But Apple has known for more than a year www.404media.…
“A vulnerability in Apple's ‘Hide My Email’ tool lets almost anyone discover a person's real email address that is supposed to be hidden by the feature, and Apple has failed to fix it for more than a year...”
Apple hasn't bothered to fix a flaw that makes a charade of its “Hide my Email” feature. This is naturally a much lower priority than going to the Supreme Court to beg for the right to keep extorting IOS software developers. — https://www.404media.co/...