WebRTC leaks, explained: what your browser is leaking and how to stop it

WebRTC is the set of browser APIs that powers video calls in your browser: Google Meet, Zoom-in-browser, Discord voice, anything peer-to-peer. To set up a call between two devices, the browsers need to find each other on the network. They do this through ICE (Interactive Connectivity Establishment), which collects a list of candidate IP addresses the browser can be reached at.

Three kinds of candidates get collected. host candidates are your device's local network IP — something like 192.168.1.5 or 10.0.0.42. srflx (server-reflexive) candidates are the public IP your NAT exposes — the one websites see. relay candidates come from a TURN server and represent the IP a media relay hands out as a fallback when direct connections fail.

A proxy or VPN routes your outbound HTTP and TCP traffic through an exit node. WebRTC's connection setup uses UDP and a separate socket from the one your HTTP traffic uses. The proxy only knows about the HTTP socket; the WebRTC traffic goes out through your real network interface, using your real local IP and exposing your real public IP to the peer.

The result: any website can run a few lines of JavaScript, create a WebRTC peer connection to a server it controls, and harvest your real public IP from the srflx candidate — even if your proxy is on, even if your DNS is on DoH, even if you've blocked every other tracker.

Three options, in increasing order of disruption. (1) Install a browser extension that intercepts ICE candidate gathering and replaces srflx candidates with the proxy exit IP. uBlock Origin has a built-in setting for this under Settings → Filter lists → Privacy. (2) Disable WebRTC entirely — Firefox has a flag at about:config: media.peerconnection.enabled = false. This breaks in-browser video calls but eliminates the leak. (3) Use a VPN whose client does WebRTC masking at the network layer, not the browser layer.

If you're a developer building a privacy tool, the right pattern is to collect the candidates, surface them to the user, and let the user decide. IPCombo's WebRTC widget does exactly this: it shows every candidate the browser gathers, labels the types, and tells you whether any of them is exposing a different IP from your proxy exit.