Mullvad's Android app passes its second independent security assessment: what was found and fixed
Leviathan Security Group tested the Mullvad VPN Android app against an industry security standard. Six issues were raised, four were real and all four have been fixed, including an in-app way to delete your account.
By Andrew Ingleton · Published
Mullvad has published the results of the 2026 security assessment of its Android app. The app was tested by the independent firm Leviathan Security Group and passed, which Mullvad says is the second year running it has done so. The headline is reassuring, but the details are more interesting than the pass mark, because they show what a VPN audit actually checks.
What was tested
The assessment is a Mobile Application Security Assessment (MASA), a standardised review run against the Mobile App Profile (MAP) specification from the App Defense Alliance. Leviathan checked version 2026.2 of the app. Mullvad then fixed the problems raised and had the changes verified in a beta of version 2026.3, which was later released as 2026.3.
Six findings, four real problems
The first round produced six findings. Mullvad says one was a false positive (about software components with known vulnerabilities) and one was not applicable (about compiler security features). That left four genuine issues, which Mullvad describes as minor. The post does not give severity ratings.
- Mutable pending intents. Some Android PendingIntents were mutable when they should not have been. Mullvad says the risk was low because the app does very little with intents, and agreed with the finding. They are now immutable.
- Sensitive details shown in plain text. The account number on the login screen, and the password for custom API access methods, were visible on screen. Both are now masked by default, which helps against someone looking over your shoulder.
- An incomplete Google Play data declaration. Mullvad stores a link between a purchase and an account for 20 days so that it can process refunds, but this was not declared in the Google Play data collection section. The listing now includes it.
- No in-app account deletion. The app previously had no way to delete an account from within it, which Mullvad says was a deliberate design choice. It has added one to meet the specification.
What it does and does not tell you
A passed assessment is useful evidence: an outside team looked at a specific version of the app, found a handful of small problems, and saw them fixed. It is not a guarantee that the app is free of bugs, and it covers the app itself rather than the whole service. It also sits alongside Mullvad's other recent security notes, such as the Android traffic-leak disclosures we covered in Your Android VPN can still leak your real IP address.
Mullvad says the technical summary, test reports and compliance report are available in the audits folder of its GitHub repository, and that the App Defense Alliance lists a certificate for the app. At the time of the post, Google had not yet published the full certificate PDF. If the assessment matters to your choice of VPN, read the reports rather than relying on the pass mark.
Why this matters in the UK
With debate about VPNs and age checks continuing, being able to point to independent testing is a real advantage for any provider. We looked at the policy side in Age verification and your VPN. On the technical side, if you use Mullvad on Android, make sure you are on a current version (2026.3 or later contains these fixes) and see our guide to Multihop modes for another setting worth reviewing.
Source: Mullvad's blog post on the 2026 security assessment of its Android app. Claims about findings and fixes are Mullvad's account of the assessment.
