CVE-2018-6849: Duckduckgo

Medium severity, CVSS 4.3. EPSS: 28.7% chance of exploitation in the next 30 days.

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

Affected products

• Duckduckgo Duckduckgo: version 4.2.0 only

Published 2018-04-01. Last modified 2026-06-17.