While this has long been known, I was never able to actually reproduce this and I'm not sure how it's technically even supposed to work. Assuming we're using I

While this has long been known, I was never able to actually reproduce this and I'm not sure how it's technically even supposed to work. Assuming we're using IPv4, the default gateway is a VPN and the machine is behind a NAT: Any outside service (e.g. STUN server) would see the VPN's IP address. How would the browser even technically be able to know the public (i.e. the NAT's) IP address? However, the WebExtensions API allows tweaking this via the webRTCIPHandlingPolicy to only reveal the public "interface" IP address. FWIW, I'm always connected to a VPN and I have configured my macOS [0] and Android [1] firewalls to drop any connection other than the VPN's. 0: Wrote it down here: https://jomo.tv/security/pf-prevent-traffic-bypassing-vpn https://jomo.tv/security/pf-prevent-traffic-bypassing-vpn 1: Quite self-explaining: https://f-droid.org/packages/dev.ukanth.ufirewall/ https://f-droid.org/packages/dev.ukanth.ufirewall/