A recently discovered bug in Android 16 allows any app to leak traffic outside the VPN tunnel.

As reported in the post The Tiny UDP Cannon: An Android VPN Bypass, Android 16 introduced a bug that allows a malicious app to send traffic outside the VPN tunnel, including with “Always-On VPN” + “Block connections without VPN” turned on. This affects all VPN apps, not just Mullvad VPN. This blog post aims to spread knowledge about this issue to help keep our users safe.

Having traffic leak outside the tunnel means your real IP address becomes visible on the Internet, which could potentially be used for tracking or surveillance purposes.

The bug was reported to the Android Security Team, but was closed as Won’t Fix (Infeasible), as described in the linked article. After consulting with the report author (https://x.com/cybaqkebm), we reported the issue on the Android issue tracker. However, at the time of writing the issue is marked as inaccessible by Google for unknown reasons.

In contrast, GrapheneOS, a security-focused Android-based OS, quickly patched the issue in its codebase.