New Android VPN bypass vulnerability allows apps to leak traffic outside VPN tunnel

Android VPN Bypass Discovered

A new vulnerability has been found in the Android network stack that permits any application to transmit traffic outside of an active VPN tunnel. This occurs even when the system's "Block all connections without VPN" feature is enabled, which is designed to prevent such leaks. The exploit allows UDP packets to bypass the VPN, revealing the device's true IP address on the internet.

Technical Details of the Leak

The vulnerability exploits Android's keep-alive UDP connection mechanism, which is offloaded to hardware Wi-Fi or cellular chips for NAT traversal. A malicious app can misuse this function to send UDP packets on port 4500 to any external server. These hardware-offloaded packets bypass the VPN tunnel enforcement, directly exposing the device's IP address without requiring any special permissions from the app.

Response and Mitigation

The researcher who discovered this leak reported it to the Android Vulnerability Reward Program, but the issue was reportedly closed by Google without any action. This suggests Google may not address the vulnerability. However, GrapheneOS has acknowledged the issue and is developing a fix. A theoretical mitigation involves saturating the limited number of hardware keep-alive connections to prevent malicious apps from creating their own, though this is not a guaranteed solution and still involves sending some traffic outside the VPN.

Implications for Users

The primary risk is the exposure of a user's real IP address, which can be used for tracking or surveillance. Since no special permissions are required for an app to exploit this, users are advised to only install trusted applications. Using security and privacy-focused Android distributions like GrapheneOS is also recommended as a more robust defense against such vulnerabilities.