How to Stop WebRTC Leaks in Chrome, Firefox, Edge, Safari and Brave

WebRTC (Web Real-Time Communication) is the technology that lets you join a video call, share your screen or send files directly from a browser tab without installing anything. To connect two people as directly as possible, WebRTC needs to discover every IP address your device could be reached on – and websites can ask for that information with a few lines of JavaScript. If your VPN is not configured carefully, that can include your real public IP address. This guide explains the leak and how to stop it in each browser.

How a WebRTC leak happens

When a page starts a WebRTC connection, your browser gathers “ICE candidates” – possible addresses for the connection:

• Host candidates: the addresses of your network interfaces, such as 192.168.1.23 or an IPv6 address.
• Server-reflexive candidates: your public address as seen by a STUN server on the internet.
• Relay candidates: addresses of a TURN relay server, if the site provides one.

With a full-device VPN, the request to the STUN server travels through the tunnel, so the server sees the VPN’s address – no leak. Problems arise when:

• the “VPN” is a browser extension proxy, which handles normal web requests but not WebRTC’s UDP traffic;
• split tunnelling excludes the browser or certain traffic;
• the VPN only covers IPv4, so your real IPv6 address is exposed as a host candidate;
• the browser exposes local interface addresses and the VPN adapter is not the default route.

Test first

Run our WebRTC leak test with the VPN off and note your public IP. Then turn the VPN on and test again. If your original public IP – IPv4 or IPv6 – appears anywhere, you have a leak. Local addresses like 192.168.x.x or random .local names are not a serious concern.

Fix 1: Use a full-device VPN app

The most reliable fix is to use the VPN provider’s desktop or mobile app rather than a browser extension, and to enable its options for WebRTC protection, IPv6 leak protection and kill switch where available. With all traffic in the tunnel, STUN requests can only see the VPN address.

Fix 2: Browser settings

Google Chrome

Chrome has no built-in switch to disable WebRTC. Since around 2019 it hides your local IP addresses behind random mDNS names by default, which removes the local-address leak. For the public address:

• Install a reputable extension that sets Chrome’s WebRTC IP handling policy, such as Google’s own “WebRTC Network Limiter” or the option in uBlock Origin (Settings › Privacy › Prevent WebRTC from leaking local IP addresses).
• These extensions make WebRTC use only the default route – which, with a VPN connected, is the VPN.

Microsoft Edge

Edge is built on Chromium and behaves like Chrome. It also hides local addresses with mDNS by default. Use the same extensions from the Edge or Chrome Web Store if your public IP leaks.

Mozilla Firefox

Firefox lets you control WebRTC directly:

1. Type about:config in the address bar and accept the warning.
2. To disable WebRTC completely, search for media.peerconnection.enabled and set it to false. This stops browser-based video calls.
3. For a softer option, keep WebRTC on and set media.peerconnection.ice.default_address_only to true so only the default route’s address is used, and make sure media.peerconnection.ice.no_host is true to hide local addresses.

Safari

Safari is conservative by default: it does not expose local IP addresses to websites unless you have granted camera or microphone access, and uses mDNS names instead. Leaks in Safari almost always come from VPN configuration, so focus on the VPN app’s settings and IPv6 handling.

Brave

Go to Settings › Privacy and security › WebRTC IP handling policy and choose Disable non-proxied UDP for the strongest protection, or Default public interface only to keep calls working while preventing local and non-VPN addresses from being shared.

Opera and Vivaldi

Both are Chromium-based. Opera has an option under Settings › Privacy & security › WebRTC; Vivaldi has a “Broadcast IP for best WebRTC performance” setting under Privacy that you can turn off.

Fix 3: Handle IPv6

If the leaked address is IPv6, your VPN is not tunnelling IPv6. Turn on the VPN’s IPv6 protection, or as a last resort disable IPv6 on your network adapter while using that VPN.

Will this break video calls?

For most people, a full-device VPN plus the “default public interface only” policy is the best balance.

Retest

After changing settings, restart the browser and run the WebRTC leak test and the VPN check. Repeat for each browser you use, because each has its own settings.