Using a new proof-of-concept, local and public IP addresses can be extracted from candidate messages sent by the API Directory’s STUN protocol requests .

Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of.