Rumor

A fake Hide My Email header can expose the address behind your Apple Account

AppleInsider • Tue, 21 Jul 2026

A forged Hide My Email header can make Mac Mail expose a user's Apple Account address, extending the privacy risk beyond people who use Apple's alias service. Apple Mail Developer Jeff Johnson disclosed the Mac Mail privacy flaw on July 19. His testing showed that a specially crafted message could make Mail display a misleading sender identity while a reply went out from the email address tied to his Apple Account. The behavior didn't require Johnson to use Hide My Email or maintain an iCloud .com mailbox. He also found that the malicious message could arrive through an unrelated personal or business account before Mail exposed the Apple Account address in a reply. Johnson said he doesn't know whether the finding is technically related to an earlier flaw that could reveal the address behind a Hide My Email alias. His report documents a separate technique and doesn't establish that both issues share the same underlying cause. Continue Reading on AppleInsider | Discuss on our Forums

What happened?

Story details

A forged Hide My Email header can make Mac Mail expose a user's Apple Account address, extending the privacy risk beyond people who use Apple's alias service.

Apple Mail Developer Jeff Johnson disclosed the Mac Mail privacy flaw on July 19.

His testing showed that a specially crafted message could make Mail display a misleading sender identity while a reply went out from the email address tied to his Apple Account.

Why it matters

This page keeps Apple rumors separate from official updates, so readers can follow early reports without confusing them with confirmed announcements.

Original source

https://appleinsider.com/articles/26/07/21/a-fake-hide-my-email-header-can-expose-the-address-behind-your-apple-account?utm_source=rss

Related coverage

Apple Updates TestFlight

Apple today updated its TestFlight app with a search field for quickly finding apps that you are beta testing, along with bug fixes and performance improvements. TestFlight version 4.3 is available now in the App Store. Tag: TestFlight This article, " Apple Updates TestFlight " first appeared on MacRumors.com Discuss this article in our forums

Apple Patches Hide My Email Flaw More Than a Year After It Was Reported

Apple addressed a vulnerability in Hide My Email that exposed a user's real email address, reports 404 Media . Apple told the site the issue was fully fixed in a patch released on July 3. The Hide My Email vulnerability was brought to Apple's attention in June 2025, but the company did not fix it until 404 Media publicized the bug in early July . EasyOptOuts co-founder Tyler Murphy, who first reported the flaw to Apple, said he was told it was under investigation. Apple told him the vulnerability was fixed in March 2026, but it had not been. In the following months, Apple said it was again looking into the problem, but Murphy was unconvinced Apple would actually address it, so he contacted 404 Media to make it public. 404 Media confirmed the vulnerability has been patched, and has now shared details on how it worked, since it can no longer be exploited. Hide My Email is a paid iCloud + feature that lets users create an anonymous email address for website sign-ups and email correspondence. Sending a targeted Hide My Email user a message that got rejected as spam caused the person's real email address to appear in email logs. "We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can't review your spam folder to learn whether you were affected," Murphy and EasyOptOuts co-founder Ben Weiner said in a new statement. "The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs," they added. While the bug has now been addressed, email logs that pre-date the fix could still expose user email addresses. Apple has been sued over the Hide My Email flaw, and the plaintiffs are seeking class action status. The lawsuit says Apple violated California's false advertising law and other consumer protection statutes because Apple knew Hide My Email did not work as advertised. Tag: Vulnerabiltiies This article, " Apple Patches Hide My Email Flaw More Than a Year After It Was Reported " first appeared on MacRumors.com Discuss this article in our forums

Future iMac could come with a removable dock or handle to make it easier to carry

It's awkward to pick up an iMac , and it's worse when you are transporting millions of them, so Apple has been researching how to give it a handle, or make a flat-pack version. Detail from the patent showing an iMac-style device sitting on a wide dock that also features multiple wireless charging sections - image credit: Apple It's not as if it's a giant market, but there are people who need to travel with their iMac and for them, existing firms will sell enormous and well-padded cases. Apple also needs to transport iMacs, though, and preferably to sell them without complex packaging. Now in a newly-granted patent called just "Low profile computer support," Apple proposes multiple ways of making it easier to move iMacs. Continue Reading on AppleInsider | Discuss on our Forums