Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address

A critical security flaw discovered in Android 16 allows malicious apps to leak a user’s real IP address even when “Always-On VPN” and “Block connections without VPN” are fully enabled, two settings users trust as an ironclad guarantee of privacy.

Discovered by security researcher 0x33c0unt and publicly disclosed on April 30, 2026, the vulnerability exploits a new Android 16 feature calledregisterQuicConnectionClosePayload, introduced for graceful QUIC connection teardowns.

The bug was reported to Google’s Android Vulnerability Reward Program on April 12, but was closed as “Won’t Fix” on April 18 before the researcher received clearance to disclose publicly on April 29.

Android 16 VPN Security Flaw

The attack abuses the fact that Android’s VPN lockdown filters traffic by app UID, but system_server (UID 1000) is exempt from those rules. A malicious app needs only two auto-granted permissions: INTERNET and ACCESS_NETWORK_STATE.

The app constructs a UDP socket bound directly to the device’s Wi-Fi IP using a plain kernel bind() call bypassing Android’s fwmark VPN enforcement and registers an attacker-controlled payload with system_server via a raw Binder transaction:

java// Direct Binder transaction to reach the hidden registerQuicConnectionClosePayload API
private static final int TXN_REGISTER = 94;

Parcel data = Parcel.obtain();
data.writeInterfaceToken("android.net.IConnectivityManager");
data.writeTypedObject(pfd, 0);
data.writeByteArray(payload.getBytes());
connectivity.transact(TXN_REGISTER, data, null, IBinder.FLAG_ONEWAY);

Once the app exits, the kernel fires a SOCK_DESTROY notification. system_server then opens a fresh UDP socket, binds it to the physical Wi-Fi interface, and transmits the attacker’s payload completely outside the VPN tunnel. The destination server receives the device’s real public IP address.

The root cause sits inConnectivityService.java: the registerQuicConnectionClosePayload method carries no permission check, not in the method body, not in the AIDL definition, and not in SELinux policy.

The flaw was confirmed on a Pixel 8 running Android 16 (build BP22.250321.011) with Proton VPN active and lockdown mode enabled.

Any app on an affected device can silently exfiltrate the device’s real IP to an attacker-controlled server without triggering any user-visible prompt or requiring elevated permissions.

Temporary Mitigation

Google has not issued a patch. Users can disable the vulnerable feature via ADB:

bashadb shell device_config put tethering close_quic_connection -1
adb reboot

This disables the QUIC teardown feature entirely. Note that a factory reset or future Mainline update could remove this workaround. A proof-of-concept app is available on GitHub.

Users relying on VPNs for anonymity journalists, activists, or privacy-conscious individuals should apply the mitigation immediately and monitor for an official Google patch.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google