# How to fix a WebRTC leak in Chrome > How to fix a WebRTC leak in Chrome: one setting stops WebRTC sending UDP around your proxy, by policy, flag or Google's extension. Measured: 2 to 0. Source: https://mosaicbrowser.com/guides/fix-webrtc-leak-in-chrome ## How to fix a WebRTC leak in Chrome To fix a WebRTC leak in Chrome, set its WebRTC IP handling so that UDP may not go around the proxy, through the WebRtcIPHandling policy, a launch flag or Google's WebRTC Network Limiter extension. Then run a leak test through the proxy and confirm only its address shows. ![2 to 0: Candidates left after one policy, measured](https://mosaicbrowser.com/covers/fix-webrtc-leak-in-chrome.webp) A WebRTC leak in Chrome is fixed with one setting: WebRTC IP handling set to `disable_non_proxied_udp`. You can set it as a browser policy, as a launch flag, or with Google's own WebRTC Network Limiter extension. Then run a leak test through the proxy and confirm the only public address on the page is the proxy's. ## What a WebRTC leak is WebRTC is how a page sets up a call or a peer-to-peer connection. To find a route, the browser gathers "candidates": addresses another machine could reach it at. One kind, the server-reflexive candidate, comes from asking a STUN server "what address do you see me at?" over UDP. A browser proxy carries web requests. That UDP question does not go through it. So a page behind a proxy can ask WebRTC for candidates and read your real public address in the reply, even though every page request went through the proxy. We measured it on our own engine, one fresh browser profile per row, with nothing else changed: | Setting | RTCPeerConnection | Candidates | | --- | --- | --- | | No policy | present | 2: an mDNS host name, and a server-reflexive candidate carrying the real home address | | `disable_non_proxied_udp` | present | 0 | Chromium's own policy text says what the value does: "WebRTC will use TCP on the public-facing interface, and will only use UDP if supported by a configured proxy" ([the policy definition](https://github.com/chromium/chromium/blob/main/components/policy/resources/templates/policy_definitions/WebRtc/WebRtcIPHandling.yaml)). The four values come from section 5.2 of [RFC 8828](https://www.rfc-editor.org/rfc/rfc8828). ## Fix 1: set the WebRtcIPHandling policy A policy applies to every window and survives restarts, which makes it the most reliable of the three. On Windows, policies live in the registry under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome` ([Google's guide](https://support.google.com/chrome/a/answer/9131254)): 1. Open Registry Editor as an administrator and go to that key, creating `Google` and `Chrome` if they are missing. 2. Add a String Value named `WebRtcIPHandling`. 3. Set its data to `disable_non_proxied_udp`. On a Mac, Google's route is a `com.google.Chrome.plist` from its enterprise bundle, converted to a configuration profile and installed ([Google's guide](https://support.google.com/chrome/a/answer/9020077)). Either way, open `chrome://policy` afterwards, press Reload policies, and find `WebRtcIPHandling` in the list with the value you set. If it is not there, Chrome is not reading it. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Its own Chromium](https://mosaicbrowser.com/features/engine) ## Fix 2: launch Chrome with the flag For a script, or a single copy of Chrome you start yourself: ``` --webrtc-ip-handling-policy=disable_non_proxied_udp ``` Spell it exactly. Chromium accepts unknown switches without a word, and we learned that the hard way. Our launcher used to pass a second line, `--force-webrtc-ip-handling-policy`, which reads like a stronger version of the same thing. Running `strings` on three binaries, including the machine's Google Chrome, found `webrtc-ip-handling-policy` in all of them and no `force-` spelling in any. That line had done nothing since the day it was written, and nothing said so. ## Fix 3: Google's WebRTC Network Limiter extension The [WebRTC Network Limiter](https://chromewebstore.google.com/detail/webrtc-network-limiter/npeicpdbkakmehahjeeohfdhnlpdklia) is published by Google and changes the same setting from a menu. Its store page says one of its options will "Require WebRTC traffic to go through proxy servers as configured in Chrome", and adds that since most proxies do not carry UDP, "this effectively turns off UDP". [BrowserLeaks](https://browserleaks.com/webrtc) recommends it as the way to limit the leak in Chrome. It is the easiest fix and applies to the Chrome profile it is installed in. ## Check the WebRTC leak in Chrome is fixed 1. Connect through the proxy and confirm an IP lookup shows the proxy's exit. 2. Open BrowserLeaks' WebRTC page. 3. Read the public addresses it lists. A fixed browser shows none, or only the proxy's. 4. Run it a second time after a restart. A setting that does not survive a relaunch is not a fix. WebRTC is one line of a longer check. The other pages worth running through the same proxy, and how to read them beside a control, are in [how to check your browser fingerprint](https://mosaicbrowser.com/guides/check-your-browser-fingerprint); the next thing a scanner compares after the address is [the browser's timezone against the IP](https://mosaicbrowser.com/guides/browser-timezone-does-not-match-ip). ## Two ways the fix goes wrong Do not set it when there is no proxy. With no proxy every packet is non-proxied by definition, so WebRTC gathers nothing at all and hides an address the site is already talking to. That protects nothing and leaves the browser unusual. In Mosaic the policy is sent for a profile with a proxy, and otherwise only when you set its WebRTC mode to Gather nothing. Do not switch off mDNS to "hide more". We once disabled mDNS obfuscation on the theory that non-proxied UDP was already off. On a profile without a proxy, the result was an empty SDP and three empty address arrays, where a stock Chrome on the same Mac offered a `.local` host candidate and a candidate with its public address. A browser whose WebRTC returns nothing at all is louder than one that behaves like Chrome. mDNS stays on in Mosaic, as in stock Chrome. ## How Mosaic handles it A Mosaic profile with a proxy launches with `--webrtc-ip-handling-policy=disable_non_proxied_udp` as long as "Block non-proxied UDP (WebRTC)" is on in the profile editor's Privacy tab, and it is on by default. It stops WebRTC from going around the proxy; it does not route WebRTC through it. The leak test in each profile's menu reads the WebRTC candidates from inside the page and fails if a public address other than the exit appears. ![A proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/shots/proxy-check.png) *The exit a profile's leak test compares WebRTC against* The rest of the pre-launch routine, from tunnelling to reputation, is in [how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it). The switch itself is one of the launch flags of [Tesseract Chrome, our own Chromium](https://mosaicbrowser.com/features/engine). ## Sources 1. [Chromium policy definition: WebRtcIPHandling](https://github.com/chromium/chromium/blob/main/components/policy/resources/templates/policy_definitions/WebRtc/WebRtcIPHandling.yaml), read November 2, 2026 2. [RFC 8828: WebRTC IP Address Handling Requirements](https://www.rfc-editor.org/rfc/rfc8828), read November 2, 2026 3. [Chrome Web Store: WebRTC Network Limiter](https://chromewebstore.google.com/detail/webrtc-network-limiter/npeicpdbkakmehahjeeohfdhnlpdklia), read November 2, 2026 4. [Google: Manage Chrome policies with Windows registry](https://support.google.com/chrome/a/answer/9131254), read November 2, 2026 5. [Google: Chrome Browser quick start (Mac), set policies](https://support.google.com/chrome/a/answer/9020077), read November 2, 2026 6. [BrowserLeaks: WebRTC Leak Test](https://browserleaks.com/webrtc), read November 2, 2026 ## Questions ### Does a VPN stop WebRTC leaks? A VPN that tunnels all of the computer's traffic carries WebRTC's UDP too, so the public address WebRTC finds is the VPN's. Leaks are mostly a proxy problem: a browser proxy carries web requests, and WebRTC's UDP goes around it. ### Does Chrome hide my local IP address in WebRTC? Stock Chrome replaces the local address in host candidates with a random .local name (mDNS). The public address found through a STUN server is a separate candidate, and that is the one that leaks around a proxy. ### Should I turn the policy on without a proxy? No. With no proxy every packet is non-proxied, so WebRTC gathers nothing and hides an address the site is already talking to. That protects nothing and makes the browser unusual. ### Will fixing the leak break video calls? It can. With disable_non_proxied_udp, WebRTC only uses UDP if the proxy supports it, and falls back to TCP through the proxy. Most HTTP proxies do not carry UDP, so calls may connect slower or not at all. ## Related [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [How to check your browser fingerprint, and read the result](https://mosaicbrowser.com/guides/check-your-browser-fingerprint): How to check your browser fingerprint: a uniqueness test says how rare it is, a consistency scanner whether it could be real. Run each twice. [Browser timezone does not match IP: what it means and the fix](https://mosaicbrowser.com/guides/browser-timezone-does-not-match-ip): Browser timezone does not match IP? Your browser reads the computer's clock, and a proxy or VPN moves only the address. Match the zone to the exit. [An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++. [Residential proxy: an exit on a home internet connection](https://mosaicbrowser.com/glossary/residential-proxy): A residential proxy sends your traffic out through an address an ISP assigned to a home connection, so sites see a household rather than a data center.    ## Run this guide on your own accounts Every Mosaic profile is a fingerprint, a proxy exit and a cookie jar that agree with each other, kept on your computer. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.