WebRTC Local & Public IP Leakage Flaw Disclosed (RFC 5245 / STUN / TURN)
Security researchers published proof-of-concept exploits showing that WebRTC JavaScript APIs in Chrome and Firefox sent unauthenticated STUN packets that bypassed active VPN tunnels and leaked the user's real public and private LAN IP addresses.
01Video Presentation & Conference Keynote
02Deep-Dive Technical Analysis
WebRTC utilizes the Interactive Connectivity Establishment (ICE, RFC 5245) protocol and STUN (RFC 5389) servers to establish peer-to-peer audio/video mesh connections across NAT firewalls. The JavaScript API `RTCPeerConnection.createOffer()` instructed the browser's network stack to query all local network interfaces and configured STUN servers directly over UDP, completely bypassing the operating system's default VPN routing table and allowing any webpage with basic JavaScript to harvest the user's true ISP-assigned IP and internal LAN subnet without user permission or browser prompt.
03Vulnerability & Exploit Flow
JavaScript-triggered unauthenticated STUN binding requests bypassing system-level VPN routing interfaces.
04Recommended Defense & Mitigation Protocol
Deploy mDNS local candidate anonymization (`.local` hostnames), browser WebRTC privacy extensions, and firewall UDP STUN port restrictions.
05Security Impact & Geopolitical Consequence
Undermined commercial VPN privacy guarantees for millions of users, prompting browser vendors to implement mDNS hostname obfuscation for local ICE candidates (RFC 8828) and configurable WebRTC IP policy controls.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.