Another way to leak traffic on Android has been discovered | Mullvad VPN

Skip to main content   Mullvad Logo Menu Products and services VPN Browser Browser extension Pricing Privacy Why privacy matters Technical resources Downloads Tech blog & news Open source Check for leaks Servers Help and support Guides FAQ VPNBrowserPricingDownloadsWhy privacy matters Log in Get started Another way to leak traffic on Android has been discovered September 10, 2026 Privacy  A newly discovered leak in Android allows any app to send traffic outside the VPN tunnel.
Yet another leak was recently discovered in the Android network stack that allows a malicious app to send traffic outside the VPN tunnel, even when "Block all connections without VPN" is active.
Having traffic leak outside the tunnel means your real IP address becomes visible on the Internet, which could potentially be used for tracking or surveillance purposes.
The malicious app does not need any special permission to perform this attack.
A proper fix would require changes in the Android system. The researcher who discovered the leak has reported the issue to the Android Vulnerability Reward Program, but according to the researcher the issue was closed without action. This issue is not public, but based on this information we deem it unlikely that Google will do anything about it. GrapheneOS is aware of the issue and are working on a fix.
Technical details
The leak involves telling Android to create a keep-alive UDP connection that is offloaded to the hardware Wi-Fi or cellular chip. The intended purpose of this connection is to help with network address translation (NAT) traversal, but a malicious app can misuse this to send UDP packets on port 4500 to any server on the Internet. As these keep-alive UDP packets are sent directly from the network hardware, they bypass the check that all traffic must go through the VPN connection when "Block all connections without VPN" is enabled, thus exposing the device's real IP address.
Mitigation
The network hardware only supports having a limited amount of keep-alive connections at the same time, so a theoretical solution could be to use some kind of application that creates its own keep-alive connection until the capacity is reached. After that any malicious app would no longer be able to create its own connection.
Mullvad does not currently have any plan to provide this theoretical mitigation ourselves as it would still involve sending packets outside to the tunnel, even though they are to a Mullvad owned server. Furthermore, such a mitigation it is not guaranteed to work, as a malicious app may have already initiated the leak before the Mullvad app is started.
Conclusion
As always, it is most important to only install trusted apps on your device, and (if possible) use a security and privacy focused Android fork like GrapheneOS. Mullvad AboutHelpServersPricingBlog Mullvad VPN Mullvad Browser Why privacy mattersWhy Mullvad VPN?What is a VPN?DownloadsStop chat controlPress Careers Policies PoliciesOpen sourcePrivacy policyCookiesTerms of servicePartnerships and resellersReviews, ads and affiliatesReporting a bug or vulnerability Address Mullvad VPN AB Box 53049 400 14 Gothenburg Sweden support@mullvadvpn.net GPG key Onion service Follow us @mullvadnet @mullvadnet Mullvad VPN mullvad Language English العربيّةDanskDeutschEnglishEspañolفارسیSuomiFrançaisItaliano日本語한국어NederlandsNorskPolskiPortuguêsРусскийSvenskaภาษาไทยTürkçeУкраїнська简体中文繁體中文

A newly discovered vulnerability in the Android network stack allows applications to bypass VPN tunnels and transmit traffic outside the secure VPN connection, even when the system setting to block all connections without a VPN is active. This leak exposes the device's true IP address on the internet, creating potential risks for tracking and surveillance. The malicious application is capable of executing this action without requiring any special permissions.

The technical mechanism behind this leak involves instructing the Android system to establish a keep-alive UDP connection that is offloaded directly to the hardware Wi-Fi or cellular chip. While this connection is intended to facilitate network address translation traversal, the malicious app misuses this functionality to send UDP packets on port 4500 to arbitrary servers on the Internet. Since these packets originate directly from the network hardware, they circumvent the security check that mandates all traffic must route through the VPN connection, thereby revealing the device’s actual IP address.

A potential theoretical mitigation exists based on the hardware limitation of keep-alive connections, which only allows a finite number simultaneously. The theoretical solution suggests deploying an application to establish its own keep-alive connection until the hardware capacity is saturated, thereby blocking the malicious app from initiating further leaks. However, the VPN provider Mullvad does not currently plan to implement this mitigation because it would still necessitate sending packets outside the tunnel, even if directed to a Mullvad-owned server, and the effectiveness of such a solution is not guaranteed because the leak might have already occurred before the VPN application was initiated.

Beyond the immediate technical fix, the text emphasizes broader security best practices. It is crucial for users to install only trusted applications on their devices, and where possible, utilize security and privacy-focused operating systems such as GrapheneOS. The issue was reported to the Android Vulnerability Reward Program by the researcher who discovered the vulnerability, although the report was closed without reported action. Furthermore, GrapheneOS is aware of this vulnerability and is actively working on a remediation.