Any Android app can leak your real IP past an always-on VPN, Mullvad warns

On 10 September 2026 Mullvad warned that Android's strictest VPN setting has a hole in it. With the system told to block all connections without a VPN, an app can still send traffic around the tunnel and expose the phone's real IP address. In Mullvad's words: "The malicious app does not need any special permission to perform this attack."

How it works

Android lets an app ask the system to keep a connection alive by sending small packets at intervals. To save battery, that job is handed to the Wi-Fi or cellular chip. Packets sent by the chip do not pass through the VPN. So an app can request a keep-alive to any server it likes, on UDP port 4500, and that server sees where the packets really come from.

The app cannot put data of its choosing into those packets. What leaks is the IP address and the timing, which is what a VPN is usually there to hide.

Who found it and what Google did

The researcher, Armin Šupuk, reported the issue to Android's vulnerability programme on 15 May 2026. By his account it was marked a duplicate of an older report four days later. Mullvad says the report was "closed without action". He tested a Pixel 8 Pro, a Samsung and a Nothing phone, all on Android 16, and believes versions back to Android 12 are affected. Google has made no public statement.

Who has fixed it

GrapheneOS, the security-focused Android variant, opened an issue on 27 August and closed it on 28 September. The notes for build 2026100200 read: "disable unprivileged hardware keepalives since it creates a VPN leak". On Pixel hardware, GrapheneOS found the leak worked only over Wi-Fi.

Mullvad says it will not ship a workaround in its own app, because the one available would itself send packets outside the tunnel.

What to do

The attack needs a hostile app on the phone, so the first defence is the dull one: fewer apps, from sources you trust. Mullvad's advice is to "only install trusted apps on your device, and (if possible) use a security and privacy focused Android fork like GrapheneOS".

If you keep a wallet or an exchange app on a phone and rely on a VPN to hide your home IP from it, assume the app could learn that IP if it wanted to. A wallet that routes its own traffic over Tor does not change this for the other apps on the same phone.

VPN providers that accept crypto and ask for no personal details are listed in the VPN category.

Sources: Mullvad, 10 Sept 2026, Armin Šupuk — write-up, GrapheneOS — releases