Android 16 VPN Bypass Exposes User IP Addresses to Malicious Apps

Key Takeaways

• A critical vulnerability in Android 16 allows malicious applications to bypass VPNs, exposing users’ real IP addresses.
• The flaw, dubbed “Tiny UDP Cannon,” exploits Android’s ConnectivityManager service, specifically the registerQuicConnectionClosePayload method.
• Even with “Always-On VPN” and “Block connections without VPN” enabled, traffic can be leaked.
• Google’s Android Security Team has classified the issue as “Won’t Fix (Infeasible),” citing it does not meet security bulletin criteria.
• A temporary ADB command mitigation is available, but a permanent official fix is currently absent.

Android 16 VPN Bypass Threatens User Privacy

A significant privacy vulnerability has been uncovered in Android 16, enabling rogue applications to circumvent Virtual Private Network (VPN) protections and reveal users’ actual IP addresses. This bypass occurs even when robust security features like “Always-On VPN” and “Block connections without VPN” are actively engaged, designed to ensure all network traffic remains within the encrypted tunnel.

Dubbed the “Tiny UDP Cannon,” this exploit allows any standard Android application, even those with only basic permissions, to force network traffic outside the established VPN connection.

How the VPN Bypass Works

The core of the problem lies within a design flaw in Android’s ConnectivityManager service. Instead of routing traffic conventionally, a malicious application can register a data payload with the system process (system_server). This process operates with elevated privileges and is not bound by the device’s VPN routing rules.

Upon the application’s termination or the destruction of its network socket, system_server then transmits the attacker-controlled data using the device’s physical network interface, such as Wi-Fi, completely bypassing the active VPN. This behavior is linked to the registerQuicConnectionClosePayload method.

This method critically lacks:

• Permission checks
• Payload validation
• Awareness of VPN lockdown policies

Consequently, even apps granted only default permissions like INTERNET and ACCESS_NETWORK_STATE can exploit this mechanism to exfiltrate data. This vulnerability fundamentally undermines Android’s VPN trust model, allowing attackers to:

• Discover a user’s genuine public IP address.
• Exfiltrate sensitive data outside encrypted VPN tunnels.
• Track user activity despite privacy measures.

The exploit was successfully demonstrated on a Pixel 8 device running Android 16, with Proton VPN active and lockdown mode engaged, confirming its efficacy in real-world scenarios.

Indicators of Compromise (IOCs)

Key indicators that suggest potential exploitation of this vulnerability include:

• Network Activity: Unauthorized UDP packets observed transmitting outside the VPN tunnel.
• Source IP: The device’s real Wi-Fi IP address (e.g., 192.168.x.x).
• Destination: An attacker-controlled server and port (e.g., port 3131).
• Payload Pattern: Arbitrary or specifically tagged data, such as EXFIL{src=IP}.
• Permissions Used: INTERNET, ACCESS_NETWORK_STATE.
• System Component: Traffic initiated by system_server (UID 1000).

Google’s Response and Mitigation

The issue was reported to Google’s Android Vulnerability Reward Program (VRP) in April 2026. However, the Android Security Team classified it as “Won’t Fix (Infeasible),” stating that it does not meet the criteria for inclusion in a security bulletin. This decision has drawn criticism from researchers, who emphasize the significant privacy risks, particularly for individuals who rely on VPNs for anonymity and security.

A temporary mitigation is available through an ADB command that disables the vulnerable QUIC feature:

• adb shell device_config put tethering close_quic_connection -1

After rebooting the device, the system ceases to send registered payloads, effectively blocking the data leak. However, researchers at lowlevel.fun caution that this is not a permanent solution and could potentially be removed in future Android updates. They warn that system-level exemptions can inadvertently create pathways for bypassing critical mobile security protections.

As VPN adoption continues its upward trend, such bypass vulnerabilities represent a critical attack vector for surveillance and data exfiltration. Users and security teams are urged to remain vigilant and implement available mitigations until a definitive official fix is provided.

What You Should Do

• Apply the ADB Mitigation: If you are an advanced user, consider applying the temporary ADB command to disable the vulnerable QUIC feature. Be aware that this is a temporary fix.
• Monitor Network Activity: Scrutinize your device’s network traffic for any unusual UDP packets originating outside your VPN tunnel, especially if you use developer tools.
• Be Cautious with App Permissions: Exercise extreme caution when granting permissions to new or unfamiliar applications, even those requesting basic network access.
• Stay Informed: Keep an eye on official Android security updates and announcements for any potential permanent fixes or further guidance from Google.
• Consider VPN Features: While “Always-On VPN” and “Block connections without VPN” are essential, understand that this vulnerability can bypass them. Evaluate if your VPN provider offers additional protective layers or features that might mitigate such leaks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.