Android VPN Flaw Leaks Real IP Addresses

A newly disclosed vulnerability in Android 16, dubbed the "Tiny UDP Cannon," poses a risk to VPN users by potentially leaking their real IP addresses. This flaw allows a malicious application, already present on a device, to send data outside of an established VPN tunnel, even when strict privacy settings like 'Always-On VPN' are enabled. The vulnerability resides in a feature intended for gracefully closing network connections, which Android fails to properly vet before sending data over unsecured connections.

While Google's Android Security Team has opted not to patch this issue, categorizing it as "Won't Fix (Infeasible)," the privacy-focused GrapheneOS has taken action. GrapheneOS has released a patch that completely disables the problematic networking feature in its latest update (release 2026050400). This effectively removes the attack surface but sacrifices a minor networking efficiency. For users on stock Android, a temporary workaround involving an ADB command exists, but it is not a permanent solution and can be reset by system updates or factory resets.