Definition
WebRTC is a browser API designed for real-time peer-to-peer voice, video, and data communication directly between browsers. To establish a peer connection, WebRTC needs to know the device's IP addresses, including any local network IPs and the public IP. It exposes these to the JavaScript on the page through a process called STUN. A page can request the IPs even without using WebRTC for its intended purpose, and the browser will hand them over silently.
Why It Defeats a VPN
If you are connected to a VPN, your browser still has both the VPN-provided IP and the underlying real IP available locally. WebRTC asks the operating system 'what are my IPs?' and reports back what it gets, regardless of which traffic is currently routed through which interface. A site can read your real public IP and even your local network address, undermining the VPN's IP-hiding entirely. This is one of the most common practical leaks on otherwise-correctly-configured VPNs.
Mitigation
Several approaches: use a browser extension that disables or mediates WebRTC (uBlock Origin has an option, dedicated extensions exist); disable WebRTC entirely in browser preferences (Firefox: about:config, media.peerconnection.enabled = false; Chrome via flags or extensions); use a browser that blocks WebRTC by default (Tor Browser, Brave with shields); test on browserleaks.com or ipleak.net after changes. Most quality VPN clients now warn users about WebRTC leaks but cannot fix them in the browser themselves.