Apple has reportedly fixed its Hide My Email vulnerability

苹果终于修复了一个让“隐藏邮箱地址”功能形同虚设的漏洞，但专家提醒用户隐私风险并未完全消失。这个漏洞出在苹果iCloud+的“隐藏我的邮箱”功能上——它本意是帮你生成一个假邮箱地址来转发邮件，从而保护真实邮箱不被泄露。结果有安全研究员发现，只要给这个假地址发一封被系统判定为垃圾邮件的退信，对方反而就能从退信日志里看到你的真实邮箱地址。苹果早在2025年6月就被告知了这个问题，但直到2026年7月3日才真正修好。更麻烦的是，发现漏洞的研究员说，修复只是挡住了后续的泄露，但之前所有通过“隐藏我的邮箱”创建的假地址，对应的真实邮箱可能已经被第三方邮件系统记录并保留在日志里了，尤其是2026年7月7日之前创建的地址。对于普通用户来说，如果你在2021年该功能上线到今年7月初之间用过“隐藏我的邮箱”，你的真实邮箱可能已经通过这种退信方式暴露给了你从未直接联系过的人或系统。今后虽然新消息不会再泄露地址，但之前的历史风险无法逆转。这件事也提醒我们，苹果引以为傲的隐私保护并非百分百无懈可击，使用这类“隐私功能”时最好不要把它当作唯一的防线，尤其对敏感账户，建议定期更换隐藏邮箱地址。

Big Tech Apple Apple has reportedly fixed its Hide My Email vulnerability An issue with iCloud+ left hidden email addresses easy to access, according to a report. By Ian Carlos Campbell July 21, 2026 2:51 pm EST Hadrian/Shutterstock Apple has patched a vulnerability in iCloud+'s Hide My Email feature that made it possible to easily view the email addresses the service is designed to obscure, 404 Media reports. The publication first reported on the vulnerability in early July and revealed that Apple had been aware of the issue for at least a year. The company originally introduced Hide My Email as a way to generate dummy email addresses for added privacy in 2021. According to 404, Apple says it deployed a software patch on July 3 that completely resolved the vulnerability. Before the company's patch, it was reportedly possible to reveal an iCloud+ user's email by sending a message to their Hide My Email-obscured address that's rejected as spam. While that's no longer possible, Tyler Murphy, co-founder of EasyOptOuts and the person who originally made 404 aware of the vulnerability, doesn't think iCloud+ users' emails are completely safe. "The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't think the risk to Hide My Email users has been eliminated," Murphy said. "Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs." Engadget has contacted Apple to comment on the Hide My Email vulnerability. We'll update this article if we hear back. Murphy reportedly told Apple about this Hide My Email issue in June 2025. Over several months, the company looked into the vulnerability and claimed to fix it. After he was still able to find hidden email addresses, Apple again told Murphy it would look into the issue. In case the company decided to leave the vulnerability unpatched, Murphy then contacted 404 with what he discovered. A large part of Apple's modern public image is based on its commitment to privacy, so the idea that the company was selling a privacy-focused feature that didn't work is naturally a problem. The issue hasn't gone unnoticed. PCMag reports the company now faces a proposed class action lawsuit over the Hide My Email vulnerability that's seeking an injunction against Apple's "deceptive conduct" and full recovery of any subscription fees customers have paid for the feature.