Researcher finds some VPN providers leak IP addresses via WebRTC bug which was discovered in 2015, but says audit is incomplete and other VPN's need testing
Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015 …
Context & Ripple Effects
This finding lands weeks after a researcher showed that Hotspot Shield, a VPN with roughly 500M users, could expose a user's WiFi network name and country despite its privacy marketing — so the WebRTC leak is the second VPN-privacy failure reported in under two months. The researcher's own caveat matters most: only part of the top-provider field was tested, meaning the ~20% figure is a floor, not a census.
First-order effects
- Around one in five top VPN services is failing at their core promise right now: browsers using WebRTC can pull customers' real IP addresses past the tunnel, on a bug publicly known since January 2015.
- The named providers face an immediate patch-or-bleed decision — block or filter WebRTC by default — while every untested rival now sits under the same question mark the researcher explicitly flagged.
Second-order effects
- WebRTC-leak protection becomes a competitive checkbox: providers that pass retest cleanly will market it, forcing laggards to follow or cede the privacy-conscious segment.
- Users and reviewers shift from trusting vendor claims to demanding published leak-test results, pressuring the same review ecosystem that coverage has already flagged as compromised by ownership conflicts like Kape Technologies' stable of VPN brands.
Third-order effects
- If the pattern holds, VPN trust consolidates around independently audited providers, because the corpus keeps showing single-vendor assurances failing — from this WebRTC leak to iOS devices not fully routing traffic through VPNs as ProtonVPN first publicized in 2020.
- The structural lesson is that VPN privacy depends on layers outside the VPN's control — browsers implementing WebRTC, mobile OSes handling routing — pointing toward leak-resistance being engineered at the OS and browser level rather than promised by providers.
The trend: VPN security is shifting from vendor-marketed privacy claims toward externally verified leak resistance, as researchers repeatedly find that tunnels fail at the browser and OS layers providers don't control.