You switched on your VPN, the app says “Connected”, and a quick IP check shows a server in another country. Job done? Not necessarily. A browser feature called WebRTC can quietly hand websites your real IP address, bypassing the tunnel you are paying for. Here is how that happens, how to test for it in under a minute, and how to fix it on every major browser.
What is WebRTC?
WebRTC (Web Real-Time Communication) is a set of browser APIs that lets two devices exchange audio, video and data directly, without a server in the middle. It powers in-browser video calls, screen sharing and many multiplayer games. It is useful technology and is enabled by default in Chrome, Firefox, Edge, Safari, Brave and Opera.
To connect two peers directly, WebRTC has to work out every address at which your device might be reachable. It uses a protocol called ICE (Interactive Connectivity Establishment) and asks public STUN servers “what IP address do you see me coming from?”. The answers are called ICE candidates:
- host candidates: your local network addresses, such as 192.168.1.17;
- srflx (server-reflexive) candidates: the public IP address a STUN server sees;
- relay candidates: addresses of a TURN relay server, if one is configured.
How a WebRTC leak happens
Any web page can create a WebRTC connection object with a few lines of JavaScript. It does not need your permission, a camera or a microphone. It only needs to read the ICE candidates the browser gathers.
The problem appears when the STUN request does not go through your VPN tunnel. That can happen if:
- your VPN uses split tunnelling and excludes the browser or UDP traffic;
- the VPN only tunnels IPv4, while your ISP also gives you IPv6;
- you use a browser proxy extension rather than a full VPN app, since extensions only route HTTP(S) traffic, while WebRTC uses UDP directly;
- the VPN client misconfigures routes after a reconnect or network change.
In any of these cases, the page sees your VPN IP over normal HTTPS and your real ISP-assigned IP via WebRTC. That is enough to de-anonymise you, link sessions together or flag you as a VPN user.
A proxy extension alone almost never protects you from WebRTC leaks. If you rely on a browser proxy, disabling or restricting WebRTC is essential.
What about local IP addresses?
Older browsers also exposed your local network address. On its own that is not catastrophic, but it adds entropy to your browser fingerprint. Modern Chrome, Edge, Safari and Firefox now hide local addresses behind random .local mDNS names, so seeing something like 4f1c...local instead of 192.168.x.x is a good sign.
How to test for a WebRTC leak
- Disconnect your VPN and note your real public IP address.
- Connect to a VPN server in another country.
- Open our Privacy Check and look at the WebRTC leak card.
- If any public IP listed there matches your real IP, or differs from the “Public IP address” card, you have a leak.
Repeat the test after switching networks, for example from Wi-Fi to mobile hotspot, and after waking your laptop from sleep. Many leaks only show up after a reconnect.
How to fix it
1. Use a VPN with proper leak protection
The cleanest fix is at the network level. A good VPN client routes all traffic, including UDP and IPv6, through the tunnel and has a kill switch that blocks traffic if the tunnel drops. Look for “IPv6 leak protection” and “block connections without VPN” in the settings, and avoid excluding your browser from the tunnel.
2. Firefox
Type about:config in the address bar and set media.peerconnection.enabled to false. This disables WebRTC completely. To keep video calls working, set media.peerconnection.ice.default_address_only to true instead.
3. Chrome, Edge and other Chromium browsers
Chromium has no built-in switch, so install a reputable extension such as WebRTC Network Limiter (published by Google) or uBlock Origin. In uBlock Origin, open Settings and tick “Prevent WebRTC from leaking local IP addresses”. Both force WebRTC to use only the default route, which is your VPN.
4. Brave
Go to Settings → Privacy and security → WebRTC IP handling policy and choose Disable non-proxied UDP. This is the strictest option and still lets most calls work through a relay.
5. Safari
Safari is the most conservative by default and does not expose IP addresses through WebRTC until a site gets camera or microphone permission. Keep “ICE candidate restrictions” enabled in the Develop menu, if you have it turned on.
6. Mobile
On iOS and Android, a full-device VPN app usually covers WebRTC because the operating system routes all traffic through the tunnel. Still, run the test once in your mobile browser, especially with always-on VPN disabled.
The bottom line
WebRTC leaks are one of the most common ways a VPN fails silently. The fix takes five minutes: choose a VPN with real leak protection, restrict WebRTC in your browser, and re-test after every network change. Bookmark our Privacy Check and make it a habit.
Leave a Reply