GoKawiilNew Android VPN Bypass Lets Apps Leak Real IP via Keep-Alive UDP Packets
Security researchers found a flaw in Android's network stack that lets any app, without special permissions, send UDP packets through the device's Wi-Fi or cellular hardware that bypass VPN tunnels entirely. This occurs even when the 'Block all connections without VPN' setting is enabled, exposing a user's real IP address. The bug was reported through Google's Vulnerability Reward Program but closed without action, while GrapheneOS says it is working on a fix.