Collected research

WebRTC IP Address Leaks

A live demonstration that any web page can use WebRTC to issue STUN requests from JavaScript and read back the visitor's local, public and IPv6 addresses without permission. The requests never appear in developer tools and cannot be blocked by extensions such as AdBlock or Ghostery, so the page deanonymises users behind NAT, VPNs and proxies.

Record

Published by

diafygi.github.io

Topic

Other

In the archive

• Collected in the 2015 research round

Related sources

• Source Repository

Tags

• webrtc
• info-leak
• javascript
• filter-bypass
• browser-extension
• tooling
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of diafygi.github.io, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.