Another way to leak traffic on Android has been discovered

A new vulnerability in Android's network stack allows malicious apps to send traffic outside VPN tunnels and expose users' real IP addresses, even when "Block all connections without VPN" is enabled, by exploiting keep-alive UDP connections intended for network hardware. The flaw requires no special permissions and was reported to Google's Vulnerability Reward Program but closed without action, though GrapheneOS is working on a fix. Users are advised to install only trusted apps and consider using privacy-focused Android alternatives like GrapheneOS.