GoKawiilNew Android VPN Bypass Lets Apps Leak Real IP via Keep-Alive UDP Packets
Security researchers found a flaw in Android's network stack that lets any app, without special permissions, send UDP packets through the device's Wi-Fi or cellular hardware that bypass VPN tunnels entirely. This occurs even when the 'Block all connections without VPN' setting is enabled, exposing a user's real IP address. The bug was reported through Google's Vulnerability Reward Program but closed without action, while GrapheneOS says it is working on a fix.
GoKawiil's interpretation of the reporting above, not reported fact.
VPN kill switches are a core privacy protection for journalists, activists, and privacy-conscious users who rely on hiding their real IP address; a silent bypass undermines that guarantee without any visible warning. Google's apparent unwillingness to patch the underlying Android network stack leaves most devices vulnerable indefinitely, shifting responsibility onto custom ROMs like GrapheneOS or third-party workarounds.
- The leak exploits hardware-offloaded keep-alive UDP connections on port 4500, bypassing VPN-only enforcement.
- No special app permissions are needed to trigger the leak, making it broadly exploitable.
- Google reportedly closed the bug report without fixing it, while GrapheneOS is developing its own mitigation.
GL.iNet GL-AXT1800 Slate AX Travel Router — If you can't trust an Android app to stay inside the VPN tunnel, move the VPN off the phone entirely inthis pocket-sized travel router runs WireGuard and OpenVPN at the network level, so every device behind it is tunneled regardless of what any app does. It's a handy layer of protection for hotel Wi-Fi and travel too.
See GL.iNet GL-AXT1800 Slate AX Travel Router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: mullvad.net, 2026-09-11
Published there as: “Another way to leak traffic on Android has been discovered”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.