WebRTC Protection

Relevant source files

The following files were used as context for generating this wiki page:

• main.js
• fingerprint.js
• README.md
• README_zh.md
• utils.js
• renderer.js

WebRTC (Web Real-Time Communication) can inadvertently leak a user's real IP address, even when a proxy is in use. GeekezBrowser implements a multi-layered defense strategy to "physically block" this leakage path, ensuring that all WebRTC traffic is routed through the configured proxy server. This is a critical feature for maintaining anonymity and isolation between browser profiles.

The protection mechanism is not a single setting but a combination of browser launch arguments, profile preference modifications, and JavaScript-level API hooking. This ensures robust and comprehensive protection against IP leaks.

Sources: README.md:40, README_zh.md:36

Architecture of WebRTC Protection

GeekezBrowser's WebRTC protection is implemented across three distinct layers, which are applied when a profile is launched. This layered approach provides redundancy and ensures that the policy is enforced at different stages of the browser's lifecycle.

The following diagram illustrates the multi-layered protection strategy.

Protection Layers Summary

Layer	Implementation Method	Description	Source File
1	Chromium Launch Argument	The --force-webrtc-ip-handling-policy argument is passed to the browser executable on startup, setting the policy at the process level.	main.js
2	Browser Preferences File	The Preferences file within the profile's user data directory is modified to set webrtc.ip_handling_policy. This persists the setting within the profile.	main.js
3	JavaScript Injection	A content script is injected into every page to hook the RTCPeerConnection constructor, forcing the iceTransportPolicy to 'relay'.	fingerprint.js

Detailed Implementation

Layer 1: Chromium Launch Argument

The most direct method of enforcement is via a command-line argument when launching the Puppeteer instance. The launch-profile handler in main.js constructs a list of arguments to be passed to the Chromium executable. Among these is the key argument for WebRTC protection.

• Argument: --force-webrtc-ip-handling-policy=disable_non_proxied_udp
• Effect: This policy instructs the browser to not use any network interface for WebRTC that is not routed through the proxy. It effectively prevents the use of local network interfaces for STUN requests, which is the primary mechanism for IP leaks.

// file: main.js:633-639
        const launchArgs = [
            `--proxy-server=socks5://127.0.0.1:${localPort}`,
            // ... other args
            '--disable-blink-features=AutomationControlled',
            '--disable-features=IsolateOrigins,site-per-process',
            '--force-webrtc-ip-handling-policy=disable_non_proxied_udp',
            `--lang=${profile.fingerprint.languages[0]}`,

Sources: main.js:633-639

Layer 2: Profile Preferences Configuration

To ensure the setting is persistent and tied to the specific profile, GeekezBrowser directly modifies the Preferences JSON file located in the profile's user data directory (<profile_id>/browser_data/Default/Preferences).

Before the browser is launched, the application reads this file, sets the webrtc.ip_handling_policy property, and writes the file back.

• File Path: path.join(userDataDir, 'Default', 'Preferences')
• JSON Property: webrtc.ip_handling_policy
• Value: disable_non_proxied_udp

// file: main.js:601-606
            if (!preferences.webrtc) preferences.webrtc = {};
            preferences.webrtc.ip_handling_policy = 'disable_non_proxied_udp';
            await fs.writeJson(preferencesPath, preferences);

            // Bookmarks
            const bookmarksPath = path.join(defaultProfileDir, 'Bookmarks');

This ensures that even if the launch argument were to fail, the browser's own configuration enforces the desired policy.

Sources: main.js:601-606

Layer 3: JavaScript Injection Hook

As a final layer of defense, a JavaScript content script is generated and injected into every webpage at document_start. This script is part of the "GeekEZ Guard" extension created for each profile. It hooks the RTCPeerConnection API to enforce a strict transport policy at runtime.

The following sequence diagram shows how the hook intercepts a new RTCPeerConnection request.

The injected script overwrites the global window.RTCPeerConnection constructor. The new function intercepts any configuration object, explicitly sets iceTransportPolicy to 'relay', and then calls the original constructor. This policy forces the connection to only use TURN servers, meaning all traffic must go through the proxy, providing a robust safeguard against direct connections.

// file: fingerprint.js:200-206
            // --- 5. WebRTC Protection ---
            const originalPC = window.RTCPeerConnection;
            window.RTCPeerConnection = function(config) {
                if(!config) config = {};
                config.iceTransportPolicy = 'relay'; 
                return new originalPC(config);
            };

This runtime protection is generated by the getInjectScript function and included in a dynamically created extension for each profile.

Sources: fingerprint.js:100-103, 200-209, main.js:101-111

Conclusion

GeekezBrowser employs a robust, three-layered strategy to prevent WebRTC-based IP leaks. By combining a process-level launch argument, a persistent profile preference, and a runtime JavaScript hook, it ensures that a user's real IP address is never exposed through WebRTC. This comprehensive approach is fundamental to the browser's promise of providing a stealthy and secure environment for multi-account management.

Sources: README.md:40, main.js:602, 638, fingerprint.js:200-206