Android flaw lets apps bypass VPN protections and expose a user’s real IP address
Security researcher Armin Šupuk has disclosed an Android flaw that allows ordinary apps to reveal a user’s real IP address even when a VPN is configured to block all traffic outside the encrypted tunnel.
Android includes both an Always-on VPN option and a Block connections without VPN setting, a combination designed to ensure that app traffic cannot leave the device unless it passes through the VPN. Šupuk found that a publicly available NAT-T keepalive mechanism can sidestep those protections.
To keep certain network connections alive, Android can offload the transmission of small keepalive packets directly to the Wi-Fi hardware. According to Šupuk, the system hands that task to the network chipset without first checking whether the app is currently subject to VPN routing rules.
As a result, an app with only the standard internet permission — with no root access, ADB or other elevated privileges — can cause those packets to be sent directly over the physical network interface instead of through the VPN tunnel.
The technique cannot be used to transmit arbitrary text or user files because Android strictly controls the contents of the keepalive packets. It can still be enough to expose a user’s identity at the network level. A malicious app could point the packets to a server it controls and receive them roughly every 10 seconds, revealing the device’s real public IP address as well as timestamps showing when it is active.
The issue could affect a large share of devices running Android 12 or later, since Wi-Fi chipsets supporting the relevant functionality are present in an estimated 91% of current Android devices.
Šupuk reproduced the behavior across phones from multiple manufacturers. On a Google Pixel 8 Pro, he was able to capture the packets through a controlled router and confirm that they were leaving outside the VPN tunnel. Tests on Samsung and Nothing devices also showed that the vulnerable mechanism could be triggered, although those tests did not include over-the-air packet capture.