WebRTC is a widespread technology in web browsers with exploits that leak IP addresses, even those protected by VPN. Keep reading for our tips to detect WebRTC leaks and disable WebRTC so your VPN can do its job.
What is WebRTC?
WebRTC (short for Web Real-Time Communication) is a technology that simplifies live video and audio streaming through a web browser. The protocol is what allows you to take a Google Hangout call or Discord voice chat directly within Firefox instead of downloading Zoom or another software.
WebRTC comes from an open-sourced project that enables any website or application to plug into its framework. It’s widely supported by most desktop web browsers and mobile operating systems.
What is a WebRTC leak?
A WebRTC leak is a common security hole for VPN users that can occur in web browsers like Google Chrome, Brave, Firefox, Opera, Vivaldi, Microsoft Edge, and Safari, just to name a few. WebRTC leaks allow websites to see your unique identifying IP address, even with an active VPN connection running. Fortunately, there are solutions and workarounds for most browsers to close WebRTC leaks.
How is WebRTC leaking IP addresses?
WebRTC works by creating a live connection through your browser. It communicates with the website you’re visiting and shares information about your device, including your IP address.
WebRTC leaks happen when live connections operate outside the encrypted tunnel established by your VPN.
A researcher from San Francisco, Daniel Roesler, posted a demonstration to illustrate how the vulnerability works. Although Roesler’s demo initially claimed that the browser vulnerability was unfixable, there are several solutions to mitigate the problem.
When it comes to the WebRTC security hole, websites can access real IP address information because of STUN servers.
STUN (Session Traversal Utilities for NAT) servers are used by VPNs to translate your true, local IP address to a new public-facing IP address and vice-versa. To function properly, the STUN server maintains a table of both your VPN’s public-facing IP and your “real” IP during connectivity. Unfortunately, your “real” VPN-issued IP address is pulled from these requests with the JavaScript APIs used in WebRTC.
The worst part is that the cause of the leak is not a bug that will be patched in the future. It’s foundational to the way WebRTC operates, so it can’t be “fixed.” It’s up to a VPN user to find a way to prevent WebRTC leaks or disable WebRTC entirely. Fortunately, you can perform a WebRTC leak test to determine if you’re affected, and there are solutions to close the vulnerability for nearly every web browser.
How to test for WebRTC leaks
It’s easy to tell if your browser’s WebRTC settings are leaking your IP address. You’ll just want to perform a WebRTC leak test on desktop or mobile.
Use this browser tool to determine if you have a WebRTC leak. If the public IP address returning doesn’t match the IP address of your VPN, you’ve got a leak.
How can WebRTC leaks be prevented?
You can prevent WebRTC leaks by disabling WebRTC requests from your browser. Nearly all web browsers need a fix, so Microsoft, Android, and Apple loyalists are equally at risk on their desktop and mobile devices.
How to disable WebRTC on Firefox
Mozilla enables WebRTC by default in its Firefox browser on desktop and mobile, but disabling the protocol is a piece of cake.
In the address bar, type about:config and set media.peerconnection.enabled to False.
How to disable WebRTC on Safari
With WebRTC in Safari’s set of Experimental Features, this browser leaks IPs too; but this fix is straightforward.
From Safari’s Preferences, go to the Advanced tab, scroll to the bottom, and click Show Develop Menu in menu bar.
Once it appears in the very top menu bar (usually between “Bookmarks” and “Window”), select Develop. The dropdown menu will show WebRTC, which can expand a second dropdown. Make sure Enable Legacy WebRTC API has no checkmark beside it to ensure it’s disabled. If the option seems inaccessible, meaning you can neither enable nor disable the option, then you likely haven’t enabled Experimental Features in Safari. This means WebRTC is already disabled.
How to disable WebRTC on Chrome mobile
While Chrome for iOS has not deeply integrated the technology, Android devices remain at risk.
The best-known fix is to type chrome://flags/#disable-webrtc into the browser address bar. Scroll down to locate and disable the WebRTC STUN origin header. Reports on Twitter in 2020 show that this is no longer 100% effective. We recommend discontinuing the use of this browser until a more reliable fix is determined.
(Related: The Best Private Browsers in 2022)
How to disable WebRTC on Chrome desktop
Google Chrome (and the 20+ other web browsers built upon the Chromium framework) face a different challenge. WebRTC is so deeply integrated into the Chrome desktop platform that disabling the protocol is nearly impossible. Fortunately, there’s a highly reliable workaround: WebRTC extensions.
- To mitigate the issue, simply install a WebRTC blocking add-on, like WebRTC Leak Prevent or the WebRTC Network Limiter released directly by Google.
Keep in mind that this method is not 100% effective. That’s because these extensions only adjust the protocol’s privacy and security settings; they can’t disable WebRTC altogether. There are some reports that leaks persist in very specific instances. So if you’re looking for a foolproof solution, consider abandoning Chrome for a different desktop browser altogether.
How to disable WebRTC on Edge
Disabling WebRTC on Edge is easier than disabling it on any other browser.
Open Microsoft Edge and type into the address bar about:flags. Scroll to the bottom of the settings and enable Hide my local IP address over WebRTC connections. Then restart your browser.
How to disable WebRTC on Opera
Disabling WebRTC on new versions of Opera takes two clicks.
Open Opera and navigate to Settings. Look for Privacy & security and click. Scroll down to WebRTC and at the last option, click to enable Disable non-proxied UDP.
Older versions of Opera may not have this setting. In this case, we recommend you use a WebRTC extension for your Opera browsers, such as WebRTC Control (link) or WebRTC Protect (link).
How to disable WebRTC on Brave
Running the Brave browser? Good for you. We’re big fans of this specific Chromium-based browser, too. This privacy-first platform has a two-prong approach to disable WebRTC.
WebRTC Handling
In the address bar, type brave://settings/, click the magnifying glass icon in the top-right corner, and enter WebRTC. Next to WebRTC IP Handling Policy, click the dropdown menu and select Default public interface only.
Fingerprinting Protection
In Settings, select Shields from the left-hand menu and look for Fingerprinting. Click the dropdown and select Block all fingerprinting.
Alternatively, those who use the affected browsers can set up a wireless home router to connect to their VPN service directly. This removes the likelihood of a software-based (or in this case, a browser-based) flaw from exposing any information about the user.
Why is my real IP still leaking?
If you’ve successfully disabled WebRTC in your browser, but your real IP address is showing on sites like whatismyip.com, your real IP address is likely leaking due to one of the following issues:
Your DNS is leaking
By default, the IPVanish app uses our private DNS servers to resolve web addresses to their respective IP addresses. This is what allows us to retrieve the content from any site you are trying to access over the VPN and send it to your device. Since our DNS servers are only accessible when connected to our VPN, our DNS is private and secure. If you are using DNS servers other than our own, your real IP address will likely leak as any other DNS servers are located outside the protection of our protected VPN tunnel and are not secure.
For more information on fixing a DNS leak, read our Support Guide to DNS leaks.
Your IPv6 is leaking
IPVanish provides automatic IPv6 leak protection whenever a VPN connection is active. However, specific desktop configuration settings may interfere with this protection, potentially exposing your IPv6 address. Double-check your IPVanish desktop app settings to ensure full security and confirm that IPv6 leak protection is enabled.
How IPVanish manages IPv6:
IPv6 is integrated into all desktop and mobile operating systems, but how it is handled varies by platform:
- Android & iOS – No manual IPv6 setting is needed because the IPVanish app automatically blocks IPv6 when connected.
- macOS – WireGuard and IKEv2 protocols automatically block IPv6. However, OpenVPN does not block IPv6 by default due to its flexible configurations (TCP/UDP/Scramble), which is why the IPVanish app includes a dedicated IPv6 leak protection setting for OpenVPN users.
- Windows – Because Windows supports all IPVanish protocols, the app includes an IPv6 protection toggle, allowing users to manage leak protection as needed.
If you’re using IPVanish on a desktop device, take a moment to review your settings and ensure IPv6 leak protection is turned on for full privacy. For more information, read our support guide to IPv6.
