# WebRTC Guide, Part 3: WHIP, E2EE, MoQ, Security and Debugging in 2026

> WebRTC in 2026: WHIP (RFC 9725) and WHEP, SFrame E2EE, WebRTC vs WebSocket, LL-HLS and MoQ, IP leaks and mDNS, libwebrtc CVEs, and debugging with getStats.

Source: https://bytevancer.com/blog/webrtc-guide-part-3-whip-e2ee-moq-2026 · Published 2026-10-30 · ByteVancer · Real-Time Web

**WHIP is an RFC, WHEP isn't yet, E2EE works through an SFU, and MoQ is still a draft. WebRTC's 2026 state, its CVEs, and how to debug a call.**

> **Part 3 of 3: WebRTC, explained** — [Part 1: What WebRTC is and how a call connects](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works) · [Part 2: Encryption, codecs, and SFU vs MCU vs mesh](https://bytevancer.com/blog/webrtc-guide-part-2-encryption-codecs-sfu) · **Part 3: WHIP, E2EE, MoQ, security and debugging (you're here)**

After the basics ([Part 1](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works)) and the internals ([Part 2](https://bytevancer.com/blog/webrtc-guide-part-2-encryption-codecs-sfu)): where WebRTC stands as of 30 Oct 2026, what competes with it, and how to secure and debug it.

## TL;DR

- WHIP (RFC 9725) ingests with one HTTP POST; WHEP (playback) is still a draft.
- SFrame plus Encoded Transform: E2EE an SFU can't read.
- MoQ has no RFC yet.
- Two WebRTC CVEs are in CISA's KEV catalog. Keep browsers updated.

## WHIP and WHEP: WebRTC over plain HTTP

WHIP (RFC 9725, March 2025, Standards Track) sends the SDP offer in an HTTP POST and returns the answer in a 201 Created, so an encoder can publish into a WebRTC server without custom signaling. WHEP, the playback twin, is not an RFC: draft-ietf-wish-whep-05 (11 Oct 2026) sits at "AD Evaluation::Revised I-D Needed".

**WHIP ingest in four steps**
Offer → POST → 201 Created → Media

1. **Offer** — Encoder creates an SDP offer.
2. **POST** — Offer goes to the WHIP endpoint.
3. **201 Created** — Answer SDP in the response.
4. **Media** — ICE and DTLS-SRTP as usual.

## End-to-end encryption through an SFU

SFrame (RFC 9605, August 2024) encrypts media frames so an SFU can read the metadata it needs but cannot decrypt. In the browser, WebRTC Encoded Transform (W3C Working Draft) runs a worker between encoder and packetizer via RTCRtpScriptTransform. MDN marks it Baseline 2025 (Chrome 141, Firefox 117, Safari 15.4).

Discord's DAVE (2 Sep 2025) uses MLS plus Encoded Transform in browsers, and Discord says it covers "tens of millions of calls … every single day".

## WebRTC vs WebSocket vs LL-HLS vs MoQ

**Specs and Apple WWDC19 session 502. The latency figure is Apple's, for LL-HLS.**
- **WebRTC** — Runs over: SRTP over UDP; data over SCTP/DTLS; Status: W3C Rec + RFCs; Fit: Two-way, real-time
- **WebSocket** — Runs over: Message framing over TCP; Status: RFC 6455 (2011); Fit: App messages
- **LL-HLS** — Runs over: HTTP; Status: Apple; Fit: "less than two seconds" at scale
- **WebTransport** — Runs over: HTTP/3 datagrams or HTTP/2; Status: W3C CR Snapshot; Fit: Custom transport
- **MoQ** — Runs over: QUIC / WebTransport; Status: IETF drafts, no RFC; Fit: Low-latency ingest + distribution

Apple puts regular HLS (6-second segments) in "the 12-second region". MoQ aims to request publication of moq-transport (draft 22) in December 2026. WebCodecs is a W3C Working Draft (Chrome M94).

**WebRTC, WebSocket, LL-HLS or MoQ?**
- Do people talk to each other live? → **WebRTC**
- Only text or app messages via a server? → **WebSocket**
- One-to-many video, 1–2 s delay is fine? → **LL-HLS**
- Happy to build on unfinished drafts? → **Prototype on MoQ**
- Otherwise → **WebRTC; measure on real networks**

## Privacy: IP leaks, mDNS and relay-only

RFC 8826: "it MUST NOT be possible for arbitrary sites to initiate calls to arbitrary locations without user consent". The W3C spec warns that ICE candidates "can reveal … location, local network topology". RFC 8828 defines four IP-handling modes: "In cases where user consent has not been obtained, Mode 2 SHOULD be used."

Since Chrome 76, local IPs hide behind mDNS names, except on sites with camera or mic permission. The mDNS draft expired without becoming an RFC. To hide IPs from the other peer, force relay-only:

*Placeholder credentials. Every byte now goes through your TURN server.*
```js
const pc = new RTCPeerConnection({
  iceServers: [{ urls: 'turn:turn.example.com', username: 'USER', credential: 'PASS' }],
  iceTransportPolicy: 'relay',
});
```

## libwebrtc CVEs: keep the browser updated

**CVE.org and Chrome Releases. Severity High unless noted. KEV = CISA Known Exploited Vulnerabilities catalog.**
- **CVE-2022-2294** — Bug: Heap overflow (KEV, added 25 Aug 2022; severity: see CVE.org); Fixed in Chrome: See CVE.org
- **CVE-2023-7024** — Bug: Heap overflow (KEV, added 2 Jan 2024); Fixed in Chrome: 120.0.6099.129
- **CVE-2024-5493** — Bug: Heap overflow; Fixed in Chrome: 125.0.6422.141
- **CVE-2024-10488** — Bug: Use-after-free; Fixed in Chrome: 130.0.6723.92
- **CVE-2025-7657** — Bug: Use-after-free; Fixed in Chrome: 138.0.7204.157
- **CVE-2025-10501** — Bug: Use-after-free; Fixed in Chrome: 140.0.7339.185
- **CVE-2026-4444** — Bug: Stack overflow; Fixed in Chrome: 146.0.7680.153
- **CVE-2026-7336** — Bug: Use-after-free; Fixed in Chrome: 147.0.7727.138
- **CVE-2026-17951** — Bug: Heap overflow (Low); Fixed in Chrome: 151.0.7922.72

Only CVE-2023-7024 and CVE-2022-2294 are in the KEV catalog. Browsers auto-update; native apps that bundle libwebrtc must ship fixes themselves.

## What Chrome has planned

- Removing legacy createDTMFSender(), targeted for Chrome 160.
- Local Network Access restrictions for WebRTC, with a permission prompt (no milestone).
- Faster SCTP negotiation, saving "up to two network round trips" (no milestone).
- Deprecating legacy kSVC.

## Testing and debugging WebRTC

- Start from the official WebRTC samples and adapter.js.
- Inspect calls in chrome://webrtc-internals; in code, getStats() returns an RTCStatsReport (WebRTC-Stats: W3C Candidate Recommendation Draft).
- Automate with fake media:

*Flags and prefs from webrtc.org/getting-started/testing.*
```bash
# Chrome
chrome --headless --use-fake-ui-for-media-stream \
  --use-file-for-fake-video-capture=path/to/video
# Firefox prefs
media.navigator.streams.fake = true
media.navigator.permission.disabled = true
```

WHIP ingest, E2EE or hardened TURN for a product? That's [web development](https://bytevancer.com/services/web-development) work we take on.

## The whole series

1. [Part 1: What WebRTC is and how a call connects](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works)
2. [Part 2: Encryption, codecs, and SFU vs MCU vs mesh](https://bytevancer.com/blog/webrtc-guide-part-2-encryption-codecs-sfu)
3. **Part 3: WHIP, E2EE, MoQ, security and debugging (this post)**

## Frequently asked questions

**What are WHIP and WHEP?**
WHIP (RFC 9725) publishes WebRTC media via an HTTP POST of the SDP offer, answered with 201 Created. WHEP does the same for playback but is still an IETF draft.

**Can WebRTC be end-to-end encrypted through an SFU?**
Yes. SFrame (RFC 9605) encrypts frames the SFU can't decrypt, applied in browsers via Encoded Transform.

**WebRTC vs WebSocket: which should I use?**
WebRTC for live audio, video or peer-to-peer data; WebSocket (RFC 6455, over TCP) for app messages through a server.

**Does WebRTC leak my IP address?**
ICE candidates can. Chrome 76+ masks local IPs with mDNS names unless the site has camera or mic permission; relay-only hides IPs from peers.

**How do I debug WebRTC in Chrome?**
Open chrome://webrtc-internals during a call, and call getStats() on the RTCPeerConnection for an RTCStatsReport.

## Keep reading

- [WebRTC Guide, Part 1: What WebRTC Is and How a Call Actually Connects](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works) — What WebRTC is and how it works: the 2021 standard, browser support, BYO signaling, SDP offer/answer, ICE, STUN and TURN, and when you need a TURN server.
- [WebRTC Guide, Part 2: Encryption, Codecs, and SFU vs MCU vs Mesh](https://bytevancer.com/blog/webrtc-guide-part-2-encryption-codecs-sfu) — How WebRTC works under the hood: mandatory DTLS-SRTP, data channels, VP8/H.264/AV1/HEVC codecs, congestion control, simulcast, and SFU vs MCU vs mesh servers.
- [All ByteVancer engineering articles](https://bytevancer.com/blog)

## Shipping live video or calls in 2026?

We build WHIP ingest, SFU integration and secure TURN setups into web products. See our [web development services](https://bytevancer.com/services/web-development) or [talk to the team](https://bytevancer.com/contact).

## Sources

- [RFC 9725 — WHIP](https://www.rfc-editor.org/rfc/rfc9725.html)
- [IETF — WHEP draft](https://datatracker.ietf.org/doc/draft-ietf-wish-whep/)
- [RFC 9605 — SFrame](https://www.rfc-editor.org/rfc/rfc9605.html)
- [W3C — Encoded Transform](https://www.w3.org/TR/webrtc-encoded-transform/)
- [MDN — RTCRtpScriptTransform](https://developer.mozilla.org/en-US/docs/Web/API/RTCRtpScriptTransform)
- [Discord blog — DAVE, Sep 2, 2025](https://discord.com/blog/bringing-dave-to-all-discord-platforms)
- [RFC 6455 — WebSocket](https://www.rfc-editor.org/rfc/rfc6455.html)
- [Apple WWDC19 session 502](https://developer.apple.com/videos/play/wwdc2019/502/)
- [W3C — WebTransport](https://www.w3.org/TR/webtransport/)
- [IETF — MoQ working group](https://datatracker.ietf.org/wg/moq/about/)
- [IETF — moq-transport draft](https://datatracker.ietf.org/doc/draft-ietf-moq-transport/)
- [W3C — WebCodecs](https://www.w3.org/TR/webcodecs/)
- [Chrome Status — WebCodecs](https://chromestatus.com/feature/5669293909868544)
- [RFC 8826 — security considerations](https://www.rfc-editor.org/rfc/rfc8826.html)
- [RFC 8828 — IP address handling](https://www.rfc-editor.org/rfc/rfc8828.html)
- [W3C — WebRTC Recommendation](https://www.w3.org/TR/webrtc/)
- [IETF — mDNS candidates draft](https://datatracker.ietf.org/doc/draft-ietf-mmusic-mdns-ice-candidates/)
- [discuss-webrtc PSA, Aug 14, 2019](https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ)
- [CVE.org — CVE-2022-2294](https://cveawg.mitre.org/api/cve/CVE-2022-2294)
- [Chrome Releases, Dec 20, 2023](https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html)
- [Chrome Releases, May 30, 2024](https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html)
- [Chrome Releases, Oct 29, 2024](https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html)
- [Chrome Releases, Jul 15, 2025](https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html)
- [Chrome Releases, Sep 17, 2025](https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html)
- [Chrome Releases, Mar 18, 2026](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html)
- [Chrome Releases, Apr 28, 2026](https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html)
- [Chrome Releases, Jul 2026](https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html)
- [CISA — KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Chrome Status — createDTMFSender()](https://chromestatus.com/feature/5160724576993280)
- [Chrome Status — Local Network Access](https://chromestatus.com/feature/5065884686876672)
- [Chrome Status — SCTP negotiation](https://chromestatus.com/feature/5137946677215232)
- [Chrome Status — legacy kSVC](https://chromestatus.com/feature/5113649939873792)
- [WebRTC samples](https://webrtc.github.io/samples/)
- [adapter.js](https://github.com/webrtc/adapter)
- [webrtc.org — Testing](https://webrtc.org/getting-started/testing)
- [W3C — WebRTC-Stats](https://www.w3.org/TR/webrtc-stats/)

---

*This is the Markdown copy of https://bytevancer.com/blog/webrtc-guide-part-3-whip-e2ee-moq-2026 — the page itself has the interactive charts and diagrams.*