Your Android VPN can still leak your real IP address: what Mullvad found and what to do

If you use a VPN on your phone to hide your home address or your location, a September disclosure from Mullvad deserves five minutes of your time. The Swedish VPN provider says it has found another way for traffic to escape from the VPN tunnel on Android, and that, as things stand, it does not expect Google to fix it.

What was found

According to Mullvad, a malicious app can send network traffic outside the VPN tunnel without needing any special permission. The trick relies on a keep-alive UDP connection, the kind normally used so that connections survive network address translation. Android hands that connection over to the Wi-Fi or cellular hardware, and packets that leave from the network chip skip the VPN check. The result is that your real IP address can be exposed to whoever the app is talking to.

The important detail is that this works even when the Block connections without VPN option (often called lockdown mode) is switched on. That setting is the one people rely on to guarantee that nothing leaves the phone unprotected, so a bypass here matters more than an ordinary leak.

Why a fix is unlikely

Mullvad published its write-up on 10 September 2026. It says the researcher reported the issue through Google’s Android Vulnerability Reward Program, but that, according to the researcher, the report was closed without action. Mullvad therefore does not expect a fix from Google.

The company also considered a workaround in its own app: opening its own keep-alive connections until the hardware limit is reached, so that a malicious app could not use them. It decided against it. The packets would still travel outside the tunnel, even if they only reached a Mullvad-owned server, and the trick could not be guaranteed to work if a malicious app had already started the leak before the Mullvad app launched.

This is the second Android disclosure of this kind from Mullvad this year; in May it described how any app on recent Android versions could leak certain traffic.

Who should worry

The attack needs a malicious app already installed on your phone, so it is not something a random website can do to you. For most people, a VPN is there to keep a café Wi-Fi network or an internet provider from watching their browsing, and that protection is largely unaffected. The people who should take this seriously are those for whom their real IP address is sensitive: journalists, activists, people avoiding an abusive ex-partner, or anyone who installs apps from outside the official store.

What you can do

• Install fewer apps, and only trusted ones. This is Mullvad’s own advice, and the most effective step, because the attack depends on a hostile app being present. Remove apps you no longer use, and be wary of sideloaded ones.
• Keep lockdown mode on anyway. It still protects you against ordinary leaks, such as the VPN dropping and reconnecting. It just cannot be treated as a guarantee on Android.
• Consider a hardened Android build. Mullvad points to GrapheneOS, a privacy- and security-focused Android fork, which it says is aware of the issue and working on a fix. Switching operating system is a big step, so weigh it against how much you need it.
• Do not rely on a phone alone for high-risk anonymity. If an exposed IP address could put you at real risk, treat the phone as a leaky device and plan accordingly.

The bigger picture

A VPN moves trust from your internet provider to the VPN company; it does not make you invisible, and it cannot be stronger than the operating system underneath it. If you are weighing up what a VPN is for, our piece on the UK’s decision not to restrict VPNs for under-16s covers the policy side, and our guide to checking the linked devices on your messaging accounts is a good example of the kind of everyday hygiene that matters just as much.

Source: Mullvad VPN, “Another way to leak traffic on Android has been discovered”, 10 September 2026.