WebRTC (Web Real-Time Communication) lets browsers negotiate real-time audio, video, and data connections. During connection setup, ICE candidates may contain host, server-reflexive, or relay addresses. Those addresses can reveal more network information than a visitor expects.

Whether this reveals an address outside a VPN depends on the browser, operating system, VPN routing, and ICE policy. Seeing a public candidate is evidence to compare—not automatic proof of a VPN leak.

How ICE Discovers Network Paths

To understand the exposure, look at how browsers establish peer-to-peer connections. Because peers may sit behind NAT and firewalls, browsers use Interactive Connectivity Establishment (ICE) to gather and test possible paths.

ICE candidates are generated by querying external STUN (Session Traversal Utilities for NAT) servers.

[Browser] --- (Queries STUN Server) ---> [Google STUN Server]
[Browser] <--- (Returns Public IP) <--- [Google STUN Server]

During this query, the browser sends traffic to the STUN server and may receive a server-reflexive candidate representing the public endpoint observed for that route.

Correctly configured VPNs normally route this traffic through the tunnel. A routing or browser-policy problem can expose a different public endpoint. Modern browsers may replace local numeric host candidates with mDNS names.

The WebRTC IP Extraction Script

Websites do not need special permissions to read your WebRTC ICE candidates. A simple script can create an empty PeerConnection, trigger candidate gathering, and parse the resulting IP addresses:

const pc = new RTCPeerConnection({
  iceServers: [{ urls: "stun:stun.l.google.com:19302" }]
});

pc.createDataChannel("");
pc.createOffer().then(offer => pc.setLocalDescription(offer));

pc.onicecandidate = (event) => {
  if (event.candidate) {
    const candidate = event.candidate.candidate;
    // Regex extracts IPv4 and IPv6 addresses from the candidate string
    const match = candidate.match(/([0-9a-f.:]+)/i);
    if (match) console.log("Detected IP:", match[1]);
  }
};

A page can trigger ICE gathering without camera or microphone permission. Candidate timing varies, and an IP address provides approximate network attribution rather than a person's precise location.

How to Test for WebRTC Leaks

To verify if your privacy setup is leaking your network configuration:

Enable your VPN or proxy.
Visit BrowserProbe's WebRTC Leak Test.
Compare any public ICE candidate with the public IP shown by the IP check and the endpoint expected from your VPN provider.
Treat a different home-ISP address as strong evidence to investigate. A private address (such as 10.x.x.x or 192.168.x.x) reveals local network topology but is not a globally routable identity.

Step-by-Step Mitigation Guide

To reduce exposure, prefer a VPN that explicitly handles WebRTC and verify its behavior after browser or VPN updates. Blocking non-proxied UDP or requiring relay candidates can reduce address exposure but may break calls or increase latency.

1. Mozilla Firefox (Native Control)

Firefox is the only browser that allows you to disable WebRTC entirely without third-party extensions:

Type about:config in the Firefox address bar and accept the risk warning.
Search for the flag: media.peerconnection.enabled.
Double-click the flag to change its value from true to false.

*Note: This will prevent WebRTC-based video calling services from running in your browser.*

2. Google Chrome & Microsoft Edge

Chromium browser controls and extension policies change over time. Prefer the current documentation from your browser and VPN vendor, and be cautious with extensions that can read browsing data.

3. Brave Browser

Brave and managed Chromium environments may expose WebRTC IP-handling policies. Use the least permissive setting compatible with the calling services you need, then rerun the comparison test.

After changing a routing policy, test both address exposure and the calling services you rely on. A clean result describes that test run; it is not a permanent guarantee.

How to Test and Prevent WebRTC IP Leaks: The Complete Guide