WebRTC Leak
A WebRTC leak is the exposure of a machine's real network addresses through the browser's ICE candidate gathering. When a page opens an RTCPeerConnection, the browser contacts STUN servers over UDP straight from the operating system network stack. That path ignores the HTTP proxy the browser was configured with. The candidates it collects, including the server-reflexive candidate carrying the public IP as the STUN server sees it, are handed back to the page through an event callback. No media, no microphone, no permission prompt.
This defeats an otherwise correct proxy setup in one step. The page already knows the source IP of the HTTP request. It compares that against the address WebRTC reported and flags the mismatch immediately. No fingerprint work upstream of this matters, because the discrepancy is a direct contradiction rather than a probabilistic signal. Chrome has for several years replaced local host candidates with randomized .local mDNS hostnames by default, which removes the LAN-address half of the problem; we could not confirm the exact milestone from a primary source, so verify it against your own build. The public reflexive candidate is the half that still leaks.
Three mitigations exist and they are not equal. Routing STUN through the proxy is the cleanest where the stack supports it: Chrome exposes a webRTCIPHandlingPolicy setting whose values are default, default_public_and_private_interfaces, default_public_interface_only and disable_non_proxied_udp (developer.chrome.com, read 2026-07-27), and the last of those forces WebRTC over the proxy or not at all. Disabling WebRTC outright is the most certain and the most conspicuous, since a real Chrome has a working RTCPeerConnection and a missing one is itself a data point. Spoofing, where the browser rewrites candidates to report the proxy address, is what most antidetect products sell, and its quality varies by implementation.
Treat this as a pre-flight check rather than a setting. Open a page that builds an RTCPeerConnection against a public STUN server, log every candidate, and compare the reported address against the IP an echo endpoint sees for the same profile. Run it per profile and per proxy, not once at setup, because a profile that passed last month can regress after an update. GoLogin, AdsPower, Octo Browser and Dolphin Anty all advertise WebRTC handling; the check tells you which of the three mitigations each one actually performs.
Tools that handle webrtc leak
4 tools in the webscrape.dev directory are commonly used for webrtc leak workflows, spanning antidetect browsers. Each is reviewed independently with pricing and editorial assessment.
GoLogin is a cloud-based antidetect browser built on the Orbita Chromium fork. It creates isolated browser profiles, each with its own spoofed fingerprint across 53 configurable parameters (canvas, WebGL, fonts, timezone), so multiple accounts on sites like Facebook, Amazon, TikTok, LinkedIn, and Instagram don't get linked or flagged. Built-in residential and mobile proxies cover more than 100 countries, and the platform supports team and profile sharing. Its REST API handles 1,200 requests per minute and works with Selenium, Puppeteer, and Playwright automation, and a recently added MCP integration lets you control profiles from Claude or GPT. GoLogin ships as a desktop app for Windows, Mac, and Linux, with a companion Android app, and it is not open source.
AdsPower is a desktop antidetect browser built for managing multiple accounts on platforms like Facebook, Amazon, Google, TikTok, and LinkedIn, each account isolated in its own profile with a spoofed fingerprint covering IP, geolocation, timezone, canvas, WebGL, WebGPU, and more than 50 other parameters across 20-plus categories. Two engines ship with it: a Chromium-based SunBrowser and a Firefox-based FlowerBrowser. It also includes RPA/automation templates, a Multi-Windows Synchronizer for driving actions across many profiles at once, and a local API for automation and integration. Proxy support covers HTTP, HTTPS, SOCKS5, and SSH, with listed compatibility for third-party providers like Bright Data and Oxylabs. Team features round it out: role-based permissions, action logs, and two-factor authentication.
Octo Browser is a Chromium-based antidetect browser for creating and managing multiple browser profiles, each with its own spoofed digital fingerprint. It runs as desktop apps for Windows, macOS, and Linux, plus a separate iOS app. Additional features include bulk profile creation, team permissions with activity logs, a marketplace for residential proxies, mobile (Android) fingerprint emulation, and an HTTP API for automation. Marketed uses include affiliate marketing, e-commerce multi-accounting, crypto airdrops, ticketing, and web scraping.
Dolphin Anty is a Chromium-based antidetect browser built for running many isolated, separately fingerprinted browser profiles from one device. It targets multi-accounting on ad platforms and social networks such as Facebook, Google, and TikTok, along with affiliate marketing and web scraping automation. Each profile lets users customize 20+ fingerprint parameters, including WebGL, WebGPU, ClientHints, webcam, and device name, and profiles can be shared across a team with permissions. Automation runs through a no-code visual constructor or a local API for scripted control, and the desktop app is available for Windows, macOS, and Linux.