A WebRTC leak is the exposure of a device's real IP addresses through WebRTC, the browser technology for peer-to-peer audio, video, and data, even when the browser is set to use a proxy or VPN. RFC 8828 notes that WebRTC's STUN checks can bypass a configured proxy and reveal the client's public IP address to a website.

WebRTC needs to find a direct network path between peers. To do that, it collects candidate addresses for the device, and a web page can read them. RFC 8828 also warns that with a split-tunnel VPN, WebRTC can discover the ISP's public address as well as the VPN's.

How the Leak Happens

  • ICE: Interactive Connectivity Establishment is the framework WebRTC uses to connect peers. It gathers candidate addresses.
  • STUN: A STUN server tells the browser its public address. That lookup can travel outside the proxy.
  • Local addresses: Candidates can include private network addresses, which RFC 8828 calls a fingerprinting surface.
  • mDNS names: An IETF draft replaces private addresses in these candidates with generated mDNS hostnames, so pages do not see the real local IP.

Limiting WebRTC Exposure

RFC 8828 defines four modes for how much address information WebRTC gathers:

  • Mode 2 (default without consent): Uses the default route and shares that interface's private addresses.
  • Mode 3: Uses the default route only and withholds private addresses.
  • Mode 4 (force proxy): Also sends media through the proxy when HTTP traffic uses one. RFC 8828 notes most proxies do not support UDP, so this can fall back to TCP and lower media quality.

How to Test for a WebRTC Leak

Any page can read the addresses WebRTC gathers. MDN notes that candidate IP addresses are always exposed to the application through the address property of each ICE candidate. To test, connect through your proxy and open a page that lists WebRTC candidate addresses. If your real public IP appears instead of the proxy's exit IP, the browser is leaking.

Browser Settings That Limit Exposure

Chromium-based browsers offer a WebRTC IP handling setting with four values:

  • Default: Uses all interfaces and exposes the local IP address.
  • Default public and private interfaces: Uses the HTTP default route and still exposes the local IP address.
  • Default public interface only: Uses the HTTP default route and does not expose the local IP address.
  • Disable non-proxied UDP: Uses TCP unless the proxy supports UDP. It does not expose local addresses. Brave makes this the default when Fingerprinting Protection is on.

In Microsoft Edge, administrators set this with the WebRtcLocalhostIpHandling policy. Brave users change it at chrome://settings/privacy.