Apple account email address disclosure via Mail app

July 19 2026

This is a follow-up to my July 10 blog post, Apple Hide My Email bug, possibly related to disclosure vulnerability. Yesterday I happened upon a Mastodon post that inspired me to continue researching my Mac Mail app bug:

curl can be used to send emails with smtp

I have multiple email accounts, for example with my personal domain lapcatsoftware.com here and my business domain underpassapp.com, but email clients such as Mail app do not provide me with full control over the sent email headers, whereas the curl command-line tool does. I can create a text file with arbitrary email headers, including, “X-Icloud-Hme”, and send the email with the following command (private information redacted):

curl --ssl-reqd --url 'smtp://[redacted]' --user '[redacted]' --mail-from '[redacted]' --mail-rcpt '[redacted]' --upload-file ~/Desktop/email.txt

Here’s an example email:

From: [redacted]
To: [redacted]
Subject: Test
Date: Sun, 19 Jul 2026 09:41:00 +0500
X-Icloud-Hme: p=Hide My Email
 <[redacted]>;f=[redacted];r=0


This is a test.

What’s notable is that I can intentionally add the “X-Icloud-Hme” header to any email and control the values of [redacted].

In my testing, this is sufficient to trigger the Mac Mail bug discussed in my previous blog post, from which I’ll repost my screenshot:

Unlike in the above screenshot, which was my reply to a customer email, the “To” and “From” fields are now under my control and can display whatever email addresses I choose, although the strange “Hide My Email” name in the “From” field remains.

Aside from the strange inability in Mail app to edit the “To” and “From” fields in my reply, the only other indicator of something amiss is the notice at the top of the received email:

The misleading user interface elements in Mail app are a bug, but by themselves they’re not a vulnerability. The vulnerability is that when I send a reply to my maliciously crafted email, my Apple account email address is disclosed in the “From” field of the sent reply! In other words, the Mail app interface lies, fails to show the true sent value of the “From” field.

There are a couple of crazy aspects to this information disclosure vulnerability:

1. It does not require that the victim actually use Hide My Email! I never use it. As I mentioned in my previous blog post, I don’t even have an icloud.com email account.
2. It does not matter which of the victim’s email accounts receives the email from the attacker. If your Apple account email address is a@foo.com, but you receive a maliciously crafted email addressed to b@bar.com, Mail app will still send your reply from a@foo.com, thereby disclosing your Apple account address.

I’m posting this vulnerability publicly because potential victims can take action to avoid it, and moreover, a lot of it was already implied by my previous blog post. If you see the weird Hide My Email in the “From” of your reply to an email, you now know to be cautious. Mail app does have a command to show All Headers of a received email, under the Message submenu of the View menu. This can also be added as a toolbar item in message windows.

I have no idea whether this vulnerability is the same as or related to another recently reported vulnerability. I’ve never communicated with those researchers or with the news media about that one and thus have no more information about it than anyone else in the public.

Addendum July 21 2026

Reporting today by 404 Media and AppleInsider appears to show that my vulnerability is different from and unrelated to the other reported Hide My Email vulnerability. From 404 Media:

Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. “We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOut co-founder Ben Weiner said in a new statement.

MacGeneration has verified my steps to reproduce, I think. (I can’t read French.)