Android 16 can leak your real IP address past a VPN: what Mullvad found in May and the workaround

A VPN on your phone is only as good as the guarantee that nothing leaves the handset outside the tunnel. In May, Mullvad published details of a flaw in Android 16 that, according to the company, breaks that guarantee. It is separate from the Wi-Fi and cellular keep-alive problem it described in September, which we covered in our earlier guide.

What Mullvad says it found

The write-up, published on 12 May 2026, says the bug sits in a system call called registerQuicConnectionClosePayload on Android's ConnectivityManager. The call exists so that a final "goodbye" payload can be sent when a QUIC connection closes. According to Mullvad, it does not check that the payload travels through the VPN, so an app can craft one that leaves the phone outside the tunnel. The destination then sees your real IP address.

Mullvad says the leak works even with Always-On VPN and "Block connections without VPN" (lockdown mode) enabled, and that it affects every VPN app, not only Mullvad's. The article names Android 16 explicitly; the title refers to "recent Android versions" but no others are listed.

Google's response

Mullvad says the issue was reported to the Android Security Team and closed as "Won't Fix (Infeasible)". It then filed the report on Google's public issue tracker, where, at the time of writing, the entry had become inaccessible. The security-focused Android variant GrapheneOS, Mullvad says, patched the problem quickly. We have not independently tested any of this, so treat the details as Mullvad's account.

Who should actually worry

The attack needs a malicious app already installed on your phone, so a website cannot trigger it. For most people a VPN is there to stop a café network or an internet provider watching their browsing, and that protection is largely unaffected. The people for whom this matters are those whose real location is sensitive: journalists, activists, or anyone avoiding someone who might control an app on their phone.

The mitigation, and its catches

Mullvad's suggested workaround is technical. It needs USB debugging enabled and a computer with Android Debug Bridge (adb):

• Run adb shell device_config put tethering close_quic_connection -1.
• Reboot the phone with adb reboot.

This switches off the graceful QUIC shutdown feature, which closes the leak. Mullvad says the setting survives reboots but may be reverted by a system update, in which case you must repeat the steps. The side effect is that server-side QUIC sockets can stay half-open until they time out, which Mullvad says should not harm the device. The company is clear that you should use the command at your own risk.

Simpler habits that help

• Install fewer apps. The flaw needs a hostile app on the device, so a short app list from the official store is your best defence.
• Use a separate device or profile for anything where your real IP must stay hidden.
• Consider GrapheneOS on a supported Pixel if your threat model justifies it, as Mullvad suggests.
• Check for updates to Android and your VPN app, and watch Mullvad's blog for news of a platform fix.

Mullvad's blog is the primary source for this story; we will update this guide if Google changes its position.