WebRTC Guide, Part 3: WHIP, E2EE, MoQ, Security and Debugging in 2026

After the basics (Part 1) and the internals (Part 2): where WebRTC stands as of 30 Oct 2026, what competes with it, and how to secure and debug it.

TL;DR

• WHIP (RFC 9725) ingests with one HTTP POST; WHEP (playback) is still a draft.
• SFrame plus Encoded Transform: E2EE an SFU can't read.
• MoQ has no RFC yet.
• Two WebRTC CVEs are in CISA's KEV catalog. Keep browsers updated.

WHIP and WHEP: WebRTC over plain HTTP

WHIP (RFC 9725, March 2025, Standards Track) sends the SDP offer in an HTTP POST and returns the answer in a 201 Created, so an encoder can publish into a WebRTC server without custom signaling. WHEP, the playback twin, is not an RFC: draft-ietf-wish-whep-05 (11 Oct 2026) sits at "AD Evaluation::Revised I-D Needed".

End-to-end encryption through an SFU

SFrame (RFC 9605, August 2024) encrypts media frames so an SFU can read the metadata it needs but cannot decrypt. In the browser, WebRTC Encoded Transform (W3C Working Draft) runs a worker between encoder and packetizer via RTCRtpScriptTransform. MDN marks it Baseline 2025 (Chrome 141, Firefox 117, Safari 15.4).

Discord's DAVE (2 Sep 2025) uses MLS plus Encoded Transform in browsers, and Discord says it covers "tens of millions of calls … every single day".

WebRTC vs WebSocket vs LL-HLS vs MoQ

Apple puts regular HLS (6-second segments) in "the 12-second region". MoQ aims to request publication of moq-transport (draft 22) in December 2026. WebCodecs is a W3C Working Draft (Chrome M94).

Privacy: IP leaks, mDNS and relay-only

RFC 8826: "it MUST NOT be possible for arbitrary sites to initiate calls to arbitrary locations without user consent". The W3C spec warns that ICE candidates "can reveal … location, local network topology". RFC 8828 defines four IP-handling modes: "In cases where user consent has not been obtained, Mode 2 SHOULD be used."

Since Chrome 76, local IPs hide behind mDNS names, except on sites with camera or mic permission. The mDNS draft expired without becoming an RFC. To hide IPs from the other peer, force relay-only:

const pc = new RTCPeerConnection({
  iceServers: [{ urls: 'turn:turn.example.com', username: 'USER', credential: 'PASS' }],
  iceTransportPolicy: 'relay',
});

libwebrtc CVEs: keep the browser updated

Only CVE-2023-7024 and CVE-2022-2294 are in the KEV catalog. Browsers auto-update; native apps that bundle libwebrtc must ship fixes themselves.

What Chrome has planned

• Removing legacy createDTMFSender(), targeted for Chrome 160.
• Local Network Access restrictions for WebRTC, with a permission prompt (no milestone).
• Faster SCTP negotiation, saving "up to two network round trips" (no milestone).
• Deprecating legacy kSVC.

Testing and debugging WebRTC

• Start from the official WebRTC samples and adapter.js.
• Inspect calls in chrome://webrtc-internals; in code, getStats() returns an RTCStatsReport (WebRTC-Stats: W3C Candidate Recommendation Draft).
• Automate with fake media:

# Chrome
chrome --headless --use-fake-ui-for-media-stream \
  --use-file-for-fake-video-capture=path/to/video
# Firefox prefs
media.navigator.streams.fake = true
media.navigator.permission.disabled = true

WHIP ingest, E2EE or hardened TURN for a product? That's web development work we take on.

The whole series

1. Part 1: What WebRTC is and how a call connects
2. Part 2: Encryption, codecs, and SFU vs MCU vs mesh
3. Part 3: WHIP, E2EE, MoQ, security and debugging (this post)