Google's Android 16 has a major security flaw that affects all VPN apps, potentially exposing users' real IP addresses and compromising their online privacy. This issue was reported by security researcher Yusef, who discovered a vulnerability in the 'Always-On VPN' and 'Block connections without VPN' settings. Despite the severity of the problem, Google has marked it as 'Won't Fix', citing it as outside their threat model. This decision has sparked controversy, as Mullvad VPN has also confirmed the issue affects all VPN apps on Android 16. The technical explanation involves a Binder method in ConnectivityManager, which can be exploited by malicious apps to leak user data. The researcher's report highlights the lack of permission checks and payload validation, allowing attackers to bypass VPN protections. This raises concerns about the reliability of VPN features on Android devices. The situation is further complicated by Google's response, which has not addressed the issue adequately. Users are left with limited options for mitigation, such as manually amending device settings or switching to alternative operating systems like Graphene OS. This incident underscores the ongoing challenges in ensuring robust security on Android platforms, and it remains to be seen if Google will reconsider its stance on this critical vulnerability.
