There’s a hole in Android’s VPN tunnel: apps can leak real IP address

Android apps can leak users’ real IP addresses even with an active VPN and “Block all connections without VPN” enabled. VPN vendors can’t fix the issue on their own. However, Google has reportedly closed the vulnerability disclosure without taking action, while GrapheneOS is working on a fix.

Use VPN all you want, but a malicious Android app can still punch a hole through it and send a UDP packet to the attacker’s server, revealing the real user's IP, a paper by Armin Šupuk, a software engineer, revealed this summer.

One of the VPN services, Mullvad, alerts Android users that the issue is real and VPNs don’t completely protect IP addresses.

“Having traffic leak outside the tunnel means your real IP address becomes visible on the internet, which could potentially be used for tracking or surveillance purposes,” Mullvad said.

The bug doesn’t negate all the protections a VPN provides – it still encrypts nearly all traffic and hides it from ISPs and other intermediaries.

However, apps can deliberately create a keep-alive UDP connection that periodically sends a packet to any server on port 4500 as long as the app keeps the connection active.

“Traffic escapes the VPN every 10 seconds and can expose the physical network’s real public IP address,” said Šupuk in a blog post detailing the VPN lockdown bypass.

“I confirmed the bypass on all 3 tested Android 16 phones: Google Pixel 8 Pro, Samsung Galaxy Z Fold7, and Nothing Phone (3a).”

The bug arises from hardware offloading – Android hands off Network Address Translation Traversal (NAT-T) keepalive connections to WiFi hardware, bypassing any normal traffic-filtering checks by VPNs.

The researcher argues that normal apps shouldn’t be allowed to open unprivileged WiFi keepalive slots. Android previously had this protection, but later removed it. It means that any app can make these calls without rooting or prompting for permissions.

A proper fix would require changes in the Android system. The researcher who discovered the leak has reported the issue to the Android Vulnerability Reward Program, but according to the researcher the issue was closed without action,

Mullvad said.

Luckily, none of the thousands of tested open-source apps have abused the feature, at least yet.

The issue was reported to Google, but the company didn’t take action to fix it. Meanwhile, GrapheneOS, a security-focused OS, acknowledged the bug. It is currently open on GitHub issue tracker.

“Leaks the IP in the form of a UDP packet to port 4500 and accepts practically any IP. Works only over WiFi on Pixel devices. Mostly doesn’t work on IPv6. Survives GOS BFU mode, the Binder freezer, etc. Pretty robust. Sends a packet every 10 seconds,” the description reads.

Mullvad said that VPN solutions can’t simply fix it by themselves – theoretically, a VPN app could create its own keep-alive connections until the limited amount of connections is exhausted, and malicious apps can’t make any more.

But this would mean the VPN app itself sends packets outside the tunnel, and there is no guarantee that a malicious app wouldn’t initiate a connection before the VPN app starts.

This IP leak is not the only one affecting Android – apps can also abuse a separate QUIC connection-teardown feature to reveal the user’s real IP address. GrapheneOS has fixed this bug, but Google didn’t, and VPN apps can’t simply close this leak.