LeakCheck

What Is a WebRTC Leak?

Last updated: September 2026

WebRTC (Web Real-Time Communication) is the browser technology behind video calls, voice chat, and peer-to-peer file sharing — it's what powers Google Meet and similar tools directly in your browser, no plugins needed.

To set up those peer-to-peer connections, WebRTC asks your device for its network addresses using STUN servers. The problem: it can discover and expose your real public IP address — bypassing the VPN tunnel entirely. Any website can run this same trick. That's a WebRTC leak: your VPN is connected, the app icon is green, and a website can still see your true IP (MakeUseOf, CyberInsider).

Test your browser for WebRTC leaks →

Free, runs in your browser, nothing stored.

Which browsers are affected?

BrowserLeak riskWhy
Chrome / Edge / Brave (Chromium) High Google co-created WebRTC and ships it deeply integrated. There is no built-in toggle to disable it — by design, so services like Google Meet keep working (Security.org).
Firefox Fixable natively Mozilla develops WebRTC too, but Firefox offers a built-in kill switch: media.peerconnection.enabled in about:config (ExpressVPN, Security.org).
Safari Low Apple's stricter permissions model means websites only see the IP you use to reach them — no extra addresses leak. The exception: if you grant a site microphone/camera permission, it may expose your IPs (ExpressVPN).
Opera Fixable natively Opera has a built-in WebRTC setting under Privacy & security: "Disable non-proxied UDP" (ExpressVPN).

How to fix a WebRTC leak, per browser

Firefox (easiest — no extension needed)

  1. Type about:config in the address bar and press Enter.
  2. Click "Accept the Risk and Continue" on the warning page.
  3. Search for media.peerconnection.enabled.
  4. Toggle it from true to false. WebRTC is now fully disabled (CyberInsider, ExpressVPN).

Trade-off: browser-based video calls (Meet, Zoom web client) will stop working until you re-enable it.

Chrome / Edge / Brave

There's no native off switch, so use an extension:

Safari

Usually nothing to do. If you want belt-and-braces: enable the Develop menu (Preferences → Advanced → "Show Develop menu"), then Develop → Experimental Features → disable "WebRTC mDNS ICE candidates" (MakeUseOf). And be stingy with microphone/camera permissions on unfamiliar sites.

Opera

  1. Open Settings → Advanced → Privacy & security.
  2. Find the WebRTC section and select "Disable non-proxied UDP" (ExpressVPN).

After the fix: verify

Whatever you changed, re-run the test to confirm the leak is actually gone:

Re-run the leak test

If the leak persists, check whether your VPN app itself offers WebRTC blocking — several providers (e.g., NordVPN) include it in their browser extensions (NordVPN support).

FAQ

Does a VPN protect against WebRTC leaks by itself?

Not reliably. The leak happens inside your browser, outside the VPN tunnel's protection. Some VPN apps include leak protection, but you should verify with a test rather than assume.

Will disabling WebRTC break anything?

Browser-based video/voice calls (Google Meet, Discord web, Zoom web client) rely on WebRTC. If you use those, prefer the "limit" approach (WebRTC Network Limiter) over fully disabling it.

Are mobile browsers affected?

Generally less so. Chrome on iOS, for example, doesn't expose the vulnerable WebRTC paths that leak IPs (TechRadar). Android browsers vary — test yours.

Sources