A newly discovered leak in Android allows any app to send traffic outside the VPN tunnel, even when "Block all connections without VPN" is active. The malicious app does not need any special permission to perform this attack, exposing the device's real IP address for potential tracking or surveillance. The researcher reported the issue to the Android Vulnerability Reward Program, but it was closed without action. Graphene OS is aware and working on a fix.

Technical details reveal the leak exploits keep-alive UDP connections offloaded to hardware Wi-Fi or cellular chips. Intended for NAT traversal, a malicious app can misuse this to send UDP packets on port 4500 to any server. These packets bypass VPN checks because they're sent directly from network hardware.

Mullvad notes mitigation is theoretically possible by filling hardware keep-alive capacity, but they won't implement it since it still sends packets outside the tunnel and isn't guaranteed to work if a malicious app initiates the leak first. The conclusion emphasizes installing only trusted apps and using privacy-focused Android forks like Graphene OS.