GrapheneOS closes an Android VPN loophole prior to Google does

A VPN that may leak your location is a fairly large failure of the tech at the most efficient of occasions, nevertheless it’s particularly regarding when Android’s lockdown controls exist to reassure you that it received’t occur. That’s the issue GrapheneOS has now addressed in Android 16, with a repair for a VPN flaw Google has reportedly determined to depart by myself.

As reported by way of TechRadar, a safety researcher going by way of lowlevel/Yusuf lately disclosed a worm nicknamed Tiny UDP Cannon. The problem impacts Android 16 and will permit a normal app to leak a small quantity of information out of doors an lively VPN tunnel, doubtlessly exposing your actual IP deal with.

Whilst no longer a fashionable possibility, the largest pink flag with the worm is that this may it sounds as if occur even if Android’s strictest VPN settings are enabled. All the time-On VPN and Block connections with out VPN are meant to save you visitors from leaving your telephone until it is going in the course of the VPN. They’re meant to come up with further peace of thoughts, however this worm creates a slim means round that coverage.

Earlier than you panic, it’s value noting that an attacker would want to get a malicious app onto your telephone first to milk this worm. That makes the daily possibility modest for many Android customers, nevertheless it’s nonetheless no longer ideally suited if you happen to depend on Android’s VPN lockdown mode as a significant privateness ensure.

The flaw seems to stem from a networking optimization in Android 16. In keeping with the researcher, Android doesn’t correctly test whether or not a tiny packet of information despatched whilst final positive connections will have to be limited by way of the VPN, so it will possibly move out over the common connection as an alternative. If the malicious app guarantees that the packet accommodates your IP deal with, it undermines one of the crucial greatest causes that individuals use VPNs within the first position.

Google’s Android Safety Workforce reportedly categorised the problem as “Received’t Repair (Infeasible)” and determined it wouldn’t be incorporated in a safety bulletin. GrapheneOS — the security-focused Android-based working machine occupied with Pixels — took a distinct course, disabling the underlying function fully in unlock 2026050400.

For GrapheneOS fanatics, it’s any other demonstration that the OS takes those privateness edge circumstances extra severely than its competitors. Inventory Android customers don’t have a neat reputable repair presently, even though the researcher notes the function will also be became off manually by way of an ADB command.