A newly discovered leak in Android allows any app to send traffic outside the VPN tunnel.Yet another leak was recently discovered in the Android network stack that allows a malicious app to send traffic outside the VPN tunnel, even when "Block all connections without VPN" is active.Having traffic leak outside the tunnel means your real IP address becomes visible on the Internet, which could potentially be used for tracking or surveillance purposes.The malicious app does not need any special permission to perform this attack.A proper fix would require changes in the Android system. The researcher who discovered the leak has reported the issue to the Android Vulnerability Reward Program, but according to the researcher the issue was closed without action. This issue is not public, but based on this information we deem it unlikely that Google will do anything about it. GrapheneOS is aware of the issue and are working on a fix.Technical detailsThe leak involves telling Android to create a keep-alive UDP connection that is offloaded to the hardware Wi-Fi or cellular chip. The intended purpose of this connection is to help with network address translation (NAT) traversal, but a malicious app can misuse this to send UDP packets on port 4500 to any server on the Internet. As these keep-alive UDP packets are sent directly from the network hardware, they bypass the check that all traffic must go through the VPN connection when "Block all connections without VPN" is enabled, thus exposing the device's real IP address.MitigationThe network hardware only supports having a limited amount of keep-alive connections at the same time, so a theoretical solution could be to use some kind of application that creates its own keep-alive connection until the capacity is reached. After that any malicious app would no longer be able to create its own connection.Mullvad does not currently have any plan to provide this theoretical mitigation ourselves as it would still involve sending packets outside to the tunnel, even though they are to a Mullvad owned server. Furthermore, such a mitigation it is not guaranteed to work, as a malicious app may have already initiated the leak before the Mullvad app is started.ConclusionAs always, it is most important to only install trusted apps on your device, and (if possible) use a security and privacy focused Android fork like GrapheneOS.