Android VPN Leak Bypasses 'Block All Connections' Security Setting

A vulnerability in the Android network stack allows malicious applications to bypass active VPN tunnels and leak a device's real IP address. The flaw undermines critical privacy settings designed to prevent data exposure when a VPN connection fails or is circumvented.

The leak occurs when an application triggers UDP keep-alive packets on port 4500, which are typically used for NAT traversal. According to reports from Mullvad VPN, these packets are offloaded directly to the device's network hardware—such as the Wi-Fi or cellular chip—effectively bypassing the operating system's network layer. Because this process happens at the hardware level, the traffic avoids the OS-level rules that govern VPN tunneling.

The Failure of the Kill Switch

For many privacy-conscious users, Android's "Block all connections without VPN" feature acts as an essential "kill switch," ensuring that no data leaves the device unless it is encrypted and tunneled. However, this vulnerability persists even when that lockdown setting is enabled.

Because the NAT keep-alive mechanism operates below the layer where these security policies are enforced, the hardware sends the packets directly to the internet. This allows any installed app to send UDP packets to any server globally without requiring special system permissions, making the leak difficult for users to detect or prevent through standard settings.

Implications for User Privacy

This discovery highlights a systemic weakness in how mobile operating systems handle network maintenance. By weaponizing a standard hardware-offloading feature, an app can deanonymize a user who believes their traffic is fully protected. This enables potential tracking or surveillance, as the real IP address is exposed to the destination server regardless of the VPN's status.

Since the exploit requires no elevated permissions, the attack surface is broad; any third-party application on the device could potentially be used to leak the user's identity. This undermines the core privacy guarantee that VPN users rely on for secure communication and anonymity.

Current Status and Mitigation

While the vulnerability affects the broader Android network stack, GrapheneOS is currently working on a fix to address the leak. It remains to be seen how other Android distributions will handle the hardware-level offloading issue.

Users should remain cautious of the permissions granted to third-party apps, although the lack of required permissions for this specific leak makes traditional app auditing less effective. Further updates are expected as GrapheneOS and other security-focused ROMs implement mitigations to ensure that hardware-offloaded traffic still respects OS-level VPN policies.