Glossary

WebRTC leak

A page reading your real IP address out of WebRTC's connection setup, bypassing the proxy the rest of the browser is using.

Also called: WebRTC IP leak.

WebRTC is the browser's peer-to-peer stack, and to connect two peers it has to work out how each of them can be reached. That process — ICE candidate gathering — enumerates the machine's own network interfaces and asks a STUN server what public address the traffic appears to come from. A page can start that process without making a call and simply read the candidates, which is how a browser that is otherwise dutifully sending everything through a proxy hands over its real address anyway.

This is the classic way around a proxy, and it is the reason a proxy alone is not a network identity. It also fails quietly: nothing about the session looks wrong, and you find out when two accounts that should never have met get actioned together. In Argus, leak protection is enforced as browser policy on the profile, beneath the JavaScript layer where a page cannot switch it off, and it is applied to every profile rather than being a toggle somebody forgets to set — assigning a proxy to a profile that was still reporting its real address upgrades it automatically. How proxies work in Argus covers this alongside the other leak it closes.