WebRTC leak

A WebRTC leak is when a site learns your real IP address even though all your traffic goes through a proxy.

WebRTC is a direct-communication technology built into the browser: calls, video, file transfer straight between two browsers. To connect directly, the browser needs to know its own addresses — so it collects them by reaching out to helper servers (STUN). These requests bypass the proxy settings, because WebRTC's job is to find the shortest path, and a proxy gets in the way of the shortest path.

As a result, the site sees two addresses: the fake one from the proxy and the real one from WebRTC. A page can read them with a couple of lines of code, with no permissions and without asking.

Why it's worse than it sounds

This isn't "one more line in the fingerprint." It's a direct contradiction: the claimed country is one thing, the real one is another. One mismatch like that is enough to link accounts you were keeping apart, and to explain a captcha where there shouldn't be one.

What we found out in practice

The leak is fixed only by a setting inside the browser profile — the one that puts WebRTC into a mode where it doesn't expose local addresses.

⚠️ A command-line flag does not help. This cost us a separate investigation of its own: launching the browser with the relevant switch looks like a fix, but changes nothing in practice — the check keeps showing the real address. Only a record in the profile's settings works, and it's applied at launch.

The practical conclusion: check the result, not the fact that you flipped a switch. "We set the flag" is not proof; proof is a check page on which the real address is gone.

Should you turn WebRTC off entirely

Turning it off completely is itself a tell: in an ordinary person WebRTC works, because video calls use it. The right move isn't to disable the technology but to cut off its access to local addresses — that way calls still work, and there's no leak.

How to check

The WebRTC leak check — free, nothing to install. It shows which addresses your browser hands out, and whether they match the proxy's address.