WebRTC Leak
A browser privacy failure where WebRTC reveals your real IP even when a proxy is active.
WebRTC is the browser API that powers in-browser video calls (Google Meet, Discord, Zoom web). To set up a call, the browser collects ICE candidates — IP addresses the device can be reached at. There are three types: host (your local network IP), srflx (the public IP your NAT exposes), and relay (a TURN server's IP). The srflx candidate is the dangerous one: it's the public IP websites see, even when your proxy is routing all other traffic through a different exit.
A WebRTC leak happens when a website harvests the srflx candidate via a few lines of JavaScript. Even with a VPN on, even with DoH, even with cookies cleared — the WebRTC stack bypasses all of it because it uses a separate UDP socket the proxy doesn't know about. The fix is either to disable WebRTC (Firefox about:config: media.peerconnection.enabled = false) or to install an extension that intercepts candidate gathering.