🚨Android Leak Allows Apps to Bypass VPNs
Your VPN isn't as secure as you think
TL;DR
A newly discovered Android leak allows apps to bypass active VPNs, exposing real IP addresses. GrapheneOS is working on a fix, but the issue remains unresolved.
A critical security flaw in Android allows any app to bypass active VPNs, exposing real IP addresses to the internet. This leak, discovered on September 10, 2026, undermines the effectiveness of 'Block all connections without VPN' settings. The issue stems from a keep-alive UDP connection that bypasses the system's traffic checks, making it possible for malicious apps to send traffic outside the tunnel without needing special permissions. GrapheneOS is aware and working on a fix, but the Android Vulnerability Reward Program has not addressed the issue. This affects everyone using Android, especially those relying on secure connections.
Key Points
Discovered on September 10, 2026, the leak allows apps to bypass active VPNs, exposing real IP addresses.
GrapheneOS is aware and working on a fix, but the Android Vulnerability Reward Program has not addressed the issue.
The leak involves a keep-alive UDP connection that bypasses system traffic checks, making it possible for malicious apps to send traffic outside the tunnel.
The issue does not require special permissions, making it easier for malicious apps to exploit.
Mullvad does not currently have a plan to provide theoretical mitigation, and it's not guaranteed to work.
Why It Matters
If you're using Android with a VPN, this leak exposes your real IP address to the internet, undermining the security of your connection. GrapheneOS is working on a fix, but the issue remains unresolved, making it crucial to only install trusted apps and consider using a security-focused Android fork like GrapheneOS.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,484 builders reading daily.