Even a VPN Can’t Protect You From This Browser Security Flaw

A VPN conceals your IP address by routing your internet traffic through a remote server, preventing anyone surveilling the network from tracking your online activity. Theoretically, that means no one should be able to identify you when you connect to a network and browse the internet, even your ISP. 

In practice, though, there are plenty of gaps that hackers can exploit. A while back, Lifehacker covered browser fingerprinting, which uses hundreds of data points, like your hardware specs, operating system version, web browser, and GPU signature, to establish a shadow profile that follows you around even when your VPN is enabled. There’s another way cyberattackers can intercept your data, and it involves exploiting a communication leak right inside your browser. 

Major browsers like Chrome, Firefox, and Edge have a feature called WebRTC that lets them bypass the encrypted Transmission Control Protocol (TCP) tunnel created by your VPN to establish high-speed connections for demanding tasks like video streaming, voice calls, and screen sharing. This leaves your real IP address exposed throughout the transmission, offering plenty of time for attackers to capture the identifying information you are trying to hide. 

Luckily, VPN providers are getting better at preventing WebRTC leaks through additional security features, but these protections often need to be configured manually in your VPN settings or, if your VPN does not offer WebRTC leak prevention, directly in your web browser. I’ll show you how to set it up step by step, so you don’t get blindsided by an unintended IP address leak. 

How WebRTC leaks bypass your VPN 

WebRTC is short for Web Real-Time Communication, a technology that lets your browser find the shortest route to connect to another device for high-bandwidth data transfer. It establishes a direct peer-to-peer connection with another device using your public IP address, improving your data transfer speeds during video and voice calls, live streaming, and screen shares. 

Everybody on the internet has probably been exposed to WebRTC connections at one point or another—for example, when you make a video call through Google Meet. Because the technology requires your public IP address to establish a faster connection, it bypasses your VPN’s default TCP encryption tunnel using a separate communication protocol called User Datagram Protocol (UDP), which foregoes safety for speed. 

WebRTC connectivity is built into most modern web browsers, including Chrome and other Chromium-based browsers, Firefox, Edge, Opera, and even Safari. It’s also enabled by default, which means that your VPN won’t conceal your IP address when you’re on a video conference or livestream unless you take separate steps to prevent unencrypted data transfers. 

Visit a website like IPLeaks or BrowserLeaks to see if your web browser is encrypted during WebRTC connections
Credit: IPLeaks

How to test for a WebRTC leak

You can test for WebRTC leaks by using specific online tools to run security checks on your browser while the VPN is switched on. Here’s how to do it: 

1. Enable your VPN using the provider’s app or browser extension. 

2. Visit a website like BrowserLeaks or IPLeaks on your preferred browser to test for leaks. 

3. Check for the results in the “WebRTC Leak Test” section of the test report. Look at the result corresponding to the “Public IP Address” field. 

4. If it says “No IP Leak,” you’re good. But if it says something like “WebRTC IP doesn’t match your Remote IP,” or displays your real IP address somewhere in that section, you’re exposed. 

How to disable WebRTC in your browser to prevent IP leaks

Many top VPN providers offer built-in WebRTC protection using network firewalls and kill switches that prevent IP leakage. However, if running a leak test reveals that your connection is exposed, your safest option is to disable WebRTC connections at the browser level (Chrome, Edge, Firefox, Opera, etc.). 

There’s a tradeoff here, because many platforms, including Google Meet and Discord on the web, require WebRTC features to function properly. With that in mind, it’s better to toggle it off during sensitive browsing sessions and flip it back on when you’re on a secure video call with someone you know. 

Not every browser handles WebRTC the same way either. For example, Firefox lets you disable the feature outright, while Safari puts in special restrictions to prevent excess data leakage, and Chrome doesn’t offer any built-in toggle without a third-party plugin. Here’s how you can disable WebRTC in most popular web browsers: 

Disabling WebRTC in Firefox

Firefox is the only major browser that lets you disable WebRTC outright, without any extensions.

1. Type about:config into the address bar and accept the risk warning.

2. Search for media.peerconnection.enabled.

3. Double-click the entry to flip its value from true to false.

Keep in mind that this breaks any site that depends on the WebRTC feature, including video calls on Google Meet or Discord. 

Disabling WebRTC in Chrome

Chrome doesn’t offer a built-in WebRTC toggle, so you’ll need a browser extension built specifically to control WebRTC handling, such as the WebRTC Control extension available on the Chrome Web Store.

1. Install a reputable WebRTC-control extension from the Chrome Web Store.

2. Set its WebRTC IP handling policy to “Disable non-proxied UDP.”

3. Reload a leak-test page to confirm your real IP address no longer shows up.

Be selective about which extension you install—a tool meant to limit WebRTC usage has no legitimate reason to request access to your browsing history or the contents of every page you visit.

Disabling WebRTC in Edge

Edge runs on the same Chromium engine as Chrome, so the solution here is the same: There’s no native off switch, but you can use a browser extension from the Microsoft Edge Add-ons store or the Chrome Web Store to disable WebRTC.

1. Install a WebRTC-blocking extension compatible with Edge.

2. Configure it to disable non-proxied UDP or block WebRTC outright, depending on what it supports.

3. If you’re okay with leaving WebRTC enabled as long as your IP address stays hidden, you can type edge://flags into your browser’s address bar and enable “Anonymize local IPs exposed by WebRTC” without installing an extension.

4. Re-test with your VPN connected to confirm the leak is closed.

Are WebRTC leaks really worth worrying about?

It seems almost every day that a new security vulnerability makes the headlines, so you might be wondering if all this precaution is worth the trouble. 

If you’d like to follow my rule of thumb, I would say that if you’re privacy-conscious enough to use a VPN, you should also pay attention to your browser’s WebRTC handling and at least anonymize your IP for UDP connections, if not disable WebRTC outright. Keep in mind that WebRTC stays enabled by default even when your browser is in Incognito Mode and you’re using a VPN at the same time, so extra precaution is worth the effort if you care about the additional privacy.