TECH Signal 337 2 feeds carried it
Android VPN bypass discovered allowing apps to leak traffic outside tunnel
↗
Illustration only Photo by Juan Pablo on Unsplash
A newly identified flaw in Android’s network stack permits apps to send UDP traffic outside a VPN tunnel, exposing real IP addresses even with strict VPN settings enabled
This vulnerability undermines a core privacy feature in Android, allowing malicious apps to bypass VPN protections without requiring special permissions. Engineers relying on VPNs for secure traffic routing must account for this leak in threat models, as no system-level fix is currently available from Google
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The leak exploits Android’s hardware-offloaded UDP keep-alive connections to bypass VPN restrictions
No special app permissions are required, making the attack accessible to any installed app
GrapheneOS is developing a fix, but Google has not addressed the reported issue in the Android codebase
THE READ
What the cluster adds up to.
The vulnerability exposes a fundamental gap in Android’s VPN enforcement mechanism. When the 'Block all connections without VPN' setting is active, the system is supposed to route all traffic through the VPN tunnel. However, the flaw allows apps to create UDP keep-alive connections that are offloaded to the Wi-Fi or cellular hardware chip, bypassing the VPN entirely. This means traffic sent via these connections reveals the device’s real IP address, regardless of VPN settings
The attack requires no elevated permissions, lowering the barrier for exploitation. Any app installed on the device can initiate the leak by creating a UDP connection on port 4500, which is then handled directly by the network hardware. This makes the vulnerability particularly dangerous, as it does not rely on user interaction or explicit consent. The only prerequisite is the app’s ability to send UDP packets, a capability available to all apps by default
Mitigation is limited and unreliable. The lead article suggests a theoretical workaround involving preemptively creating keep-alive connections to exhaust the hardware’s capacity, but this is not a guaranteed solution. Even if implemented, a malicious app could still initiate the leak before the mitigation takes effect. The only robust fix would require changes to Android’s network stack, which Google has reportedly declined to implement. GrapheneOS, a privacy-focused Android fork, is working on a patch, but mainstream Android users remain exposed
The implications for privacy and security are significant. VPNs are often used to protect against tracking, surveillance, or IP-based attacks, and this leak undermines that protection. Engineers and operators must assume that any app on an Android device could potentially expose the device’s real IP address, even when VPN settings are configured to block non-VPN traffic. This shifts the burden of protection to app vetting and alternative security measures, such as using hardened Android forks or additional network-level filtering
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER