Executive brief
GrapheneOS (a security-focused version of Android) contained a flaw that could allow a malicious app to discover a user's real IP address even when a VPN is set to 'Always-on' and 'Block connections without VPN' mode. By exploiting a feature designed to gracefully close network connections, an app could trick the system into sending data directly over the cellular or Wi-Fi network instead of through the protected VPN tunnel. This undermines the privacy of users who rely on VPNs to hide their physical location and identity.
Technical details
A vulnerability exists in GrapheneOS (inherited from Android 16) where the 'registerQuicConnectionClosePayload' optimization in the ConnectivityManager allows an application to register an arbitrary UDP payload with the system_server. When the application's UDP socket is destroyed, the system_server transmits this payload on the socket's original network interface. Because system_server operates with elevated privileges (UID 1000) and is exempt from VPN routing restrictions, the packet is sent over the physical interface (Wi-Fi or cellular) rather than the VPN tunnel. This occurs even if 'Always-on VPN' and 'Block connections without VPN' are enabled. The flaw is categorized as a 'Confused Deputy' (CWE-441) issue because the system does not validate the payload or check the VPN-lockdown state of the calling application. GrapheneOS fixed this by disabling the optimization in version 2026050400.
Affected products
- GrapheneOS GrapheneOS before 2026050400
Timeline
- 2026-04-29: disclosed: Public disclosure authorized after vendor (Google) declined to patch stock Android
- 2026-04-30: other: Technical write-up published by researcher 'lowlevel/Yusuf'
- 2026-05-04: patched: GrapheneOS release 2026050400 disables the vulnerable optimization
- 2026-05-09: advisory: CVE-2026-45182 published