WebRTC Local & Public IP Leakage Flaw Disclosed (RFC 5245 / STUN / TURN)
Daniel Roesler's 2015 proof-of-concept showed that the WebRTC JavaScript APIs in Chrome and Firefox let any web page collect a user's private LAN addresses and real public IP — even behind an active VPN. The behaviour had already been tracked by Mozilla as Bugzilla 959893 ("WebRTC Internal IP Address Leakage"); it was treated as a privacy design issue and received no CVE.
02Deep-Dive Technical Analysis
WebRTC uses Interactive Connectivity Establishment (ICE, RFC 5245) and STUN (RFC 5389) to gather candidate addresses for peer-to-peer audio/video sessions across NAT. Calling `RTCPeerConnection` and `createOffer()` made the browser enumerate local network interfaces and send STUN binding requests over UDP, and the resulting host and server-reflexive candidates were readable from JavaScript without any permission prompt. In many VPN configurations those requests did not follow the tunnel, exposing the ISP-assigned address. Mozilla Bugzilla 959893, opened by researchers from BAE Systems Detica, documented the internal-IP exposure and the VPN de-anonymization concern well before the public PoC.
03Vulnerability & Exploit Flow
JavaScript-triggered ICE candidate gathering and STUN binding requests that reveal local and public IP addresses outside the VPN tunnel.
04Recommended Defense & Mitigation Protocol
Deploy mDNS local candidate anonymization (`.local` hostnames), restrictive WebRTC IP-handling policies or privacy extensions, and firewall rules that force UDP STUN traffic through the VPN.
05Security Impact & Geopolitical Consequence
Undermined commercial VPN privacy guarantees for millions of users, prompting browsers to add WebRTC IP-handling policies and mDNS hostname obfuscation for host ICE candidates — approaches later codified in RFC 8828 (WebRTC IP Address Handling Requirements).
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.