Unpatched Android VPN Flaws Can Expose Users’ Real IP Addresses

An Android VPN leak can expose a user’s real IP address even when VPN lockdown and “Block all connections without VPN” remain active. Researchers have identified two unpatched flaws that allow apps to send certain traffic outside the encrypted tunnel.

The more recent issue abuses Wi-Fi keepalive packets and can transmit data every 10 seconds. VPN providers cannot reliably prevent the leak because the weakness exists within Android itself.

Malicious Apps Can Bypass the VPN Tunnel

Software engineer Armin Šupuk disclosed one of the flaws during the summer of 2026. His research shows that a malicious Android app can send a UDP packet directly to an attacker-controlled server.

That packet travels outside the VPN tunnel and reveals the public IP address of the user’s physical network. An attacker could potentially use this information for tracking or surveillance.

The flaw does not disable every benefit that a VPN provides. Most traffic remains encrypted and hidden from internet service providers and other intermediaries. However, the escaped packet can still reveal information that many people use a VPN to conceal.

Wi-Fi Keepalive Packets Cause the Leak

An app can create a Network Address Translation Traversal keepalive connection and send packets to a server through port 4500. As long as the connection remains active, traffic can leave the device approximately every 10 seconds.

Android hands these NAT-T keepalive connections to the device’s Wi-Fi hardware. This hardware offloading process bypasses the traffic filters that VPN applications normally use.

According to Šupuk, ordinary apps once faced restrictions that prevented them from opening unprivileged Wi-Fi keepalive slots. Android later removed that protection. Consequently, any app can now use the feature without requesting permission or gaining root access.

The researcher confirmed the bypass on three Android 16 devices: a Google Pixel 8 Pro, Samsung Galaxy Z Fold7 and Nothing Phone (3a).

Tests also indicate that the leak mainly affects Wi-Fi connections and usually does not work over IPv6. Nevertheless, the technique remains reliable enough to expose an IPv4 address repeatedly.

VPN Providers Cannot Offer a Reliable Fix

Mullvad has warned its Android users about the vulnerability. The VPN provider explained that a complete fix would require changes to the Android operating system.

In theory, a VPN app could occupy all available keepalive connections before another application uses them. However, this workaround would force the VPN itself to transmit packets outside its tunnel.

Furthermore, a malicious app could establish its connection before the VPN starts. Therefore, VPN developers cannot guarantee that this approach would prevent the Android VPN leak.

The researcher reported the problem through Google’s Android Vulnerability Reward Program. However, Google reportedly closed the submission without implementing a fix.

GrapheneOS has acknowledged the vulnerability and continues to track it through its issue system. Researchers have not found evidence that any of the thousands of tested open-source applications currently exploit the feature.

A Second Android Flaw Creates Another IP Leak

Android also contains a separate vulnerability involving QUIC connection teardown. Apps can abuse this mechanism to send traffic outside a VPN and reveal the device’s real IP address.

GrapheneOS has already fixed the second problem in its security-focused operating system. However, standard Android reportedly remains vulnerable, while individual VPN providers cannot close the gap themselves.

Together, the two flaws show that Android’s lockdown settings do not block every possible connection outside a VPN tunnel. Users still receive protection for most of their online activity, but they cannot assume that their real IP address will always remain hidden.