A number of solutions  are available for tunnelling IP over Websockets to masquerade a VPN as browser traffic. How well are these connections isolated though? Specifically, if the browser happens to run on a host behind a corporate gateway that is set up to MitM all TLS traffic, will the gateway have the means to decrypt the tunneled connection?
AFAICS there is no suite of standards to consult as there is for IPSec, hence the lack of specificity in the question.
 E. g. https://github.com/unbit/vpn-ws