GoKawiilAndroid NAT-T keepalive API lets apps bypass VPN lockdown mode
Security researchers found that Android's public NAT-T socket-keepalive API allows ordinary apps to send UDP packets directly to a router, bypassing Always-on VPN and 'Block connections without VPN' protections. Tests on a Pixel 8 Pro, Samsung SM-F966B, and Nothing A059, all running Android 16, confirmed that keepalive packets reached the physical gateway outside the VPN tunnel, with one device sustaining a leak for over 24 hours. The root cause traces to changes in Android's startNattKeepaliveWithFd function, where validation checks tying the socket to the caller's VPN policy were added and later removed.