GoKawiilSeptember 10, 2026 Privacy
A newly discovered leak in Android allows any app to send traffic outside the VPN tunnel.
Yet another leak was recently discovered in the Android network stack that allows a malicious app to send traffic outside the VPN tunnel, even when "Block all connections without VPN" is active.
Having traffic leak outside the tunnel means your real IP address becomes visible on the Internet, which could potentially be used for tracking or surveillance purposes.
The malicious app does not need any special permission to perform this attack.
A proper fix would require changes in the Android system. The researcher who discovered the leak has reported the issue to the Android Vulnerability Reward Program, but according to the researcher the issue was closed without action. This issue is not public, but based on this information we deem it unlikely that Google will do anything about it. GrapheneOS is aware of the issue and are working on a fix.
Technical details
The leak involves telling Android to create a keep-alive UDP connection that is offloaded to the hardware Wi-Fi or cellular chip. The intended purpose of this connection is to help with network address translation (NAT) traversal, but a malicious app can misuse this to send UDP packets on port 4500 to any server on the Internet. As these keep-alive UDP packets are sent directly from the network hardware, they bypass the check that all traffic must go through the VPN connection when "Block all connections without VPN" is enabled, thus exposing the device's real IP address.
Mitigation
The network hardware only supports having a limited amount of keep-alive connections at the same time, so a theoretical solution could be to use some kind of application that creates its own keep-alive connection until the capacity is reached. After that any malicious app would no longer be able to create its own connection.
... continue reading