Android Leaks Wi-Fi Traffic Even When VPN Protection Features Are On

The platform lets network connectivity data escape outside of the secure tunnel when connected to a public network, posing a privacy concern for users with certain threat models, researchers said.

Android devices are leaking certain traffic when a mobile device is connected to a Wi-Fi network, even when features aimed to protect data being sent over the public Internet by using virtual private networks (VPNs) are enabled.
The issue could poke a hole in a users ability to remain anonymous when using a VPN to encrypt data being sent from an Android device over a public Wi-Fi network, allowing a would-be attacker to monitor a users traffic and even pinpoint someones location, researchers noted.
A security audit conducted by Mullvad VPN identified the issue, which it
reported to Google
s Android team. It found that the Android mobile OS — which has nearly 3 billion users worldwide — is sending connectivity checks outside the VPN tunnel.
It does this every time the device connects to a Wi-Fi network, even when the
Block connections without VPN
setting is enabled, they wrote in the post. The connection check traffic can be observed and analyzed by the party controlling the connectivity check server and any entity observing the network traffic.
This could allow a threat actor to derive information beyond merely the fact that the Android device is connected, such as a users location if combined with data such as Wi-Fi access point locations, the Mullvad researchers noted.
Android, for its part, says the function is working as intended, and that no fix is necessary.
Defending Default Behavior
It makes sense for Android to send connectivity data traffic by default, the Mullvad researchers acknowledged, such as when there is a captive portal on the network, they said.
In this case, the connection will be unusable until the user has logged in to it, so most users will want the captive portal check to happen and allow them to display and use the portal, the researchers wrote.
Still, as there seems to be no way to prevent Android from leaking traffic, the issue remains unresolved and potentially a risk for some users, the researchers said. Moreover, Androids current documentation about how the OS blocks connections without a VPN is misleading, they wrote, even if a user is fine with some traffic going outside the VPN tunnel.
As it would require a sophisticated actor to use connectivity checks against someone using an Android phone, most of our users are probably unlikely consider it a significant risk, the researchers acknowledged.
But the feature as currently documented by Android gives a user the impression that no traffic will leave the phone except through the VPN when the feature is turned on, which is not the case, the Mullvad researchers said.
Previously, on Sept. 29, Mullvad had posted on Android IssueTracker suggesting a change to the documentation regarding the Block connections without VPN feature to alert users to potential data leakage.
To remedy this issue, researchers suggested adding except connectivity checks to documentation references that claim the feature allows people using a device or an IT admin to force all traffic to use the VPN, or blocks any network traffic that doesnt use the VPN for clarification. The issue remains pending.
Dark Reading has reached out to Android for comment.
Connection Checks Working as Intended
The researchers reported the mobile systems actual leaking of connectivity data to Android on its IssueTracker message board site. Android responded quickly that it was looking into it.
A Google engineer later defended the current state of the Block connections without VPN feature, responding that the status of the issue is Wont Fix as this is working as intended in a comment posted Oct. 6.
The engineer stated four reasons for declining to add an option in Android to disable connectivity checks. One is that the VPN might be actually relying on the result of these connectivity checks, while another is that the VPN may be a split tunnel, letting part of the traffic over the underlying network, or only affect a given set of apps.
Further, the connectivity checks are far from the only thing exempted from the VPN, as privileged apps can also bypass the VPN, and this is necessary for their operation in many cases, the engineered stated.
Finally, Googles position is that its unclear as to what specific impact on privacy the issue has, as connectivity checks reveal there is an Android device at this address, which is plenty clear from the L2 connection and from the traffic going over the VPN anyway, according to the engineer.
High-Profile Risk
Mullvads point that the leak could pose a threat to some users certainly has validity, especially given the increased interest by state-sponsored threat actors to use
spyware
and other ways to
monitor and even persecute high-profile Android users
such as journalists, activists, academics, and politicians.
VPNs are meant to ensure that network connections using them encrypt Internet traffic over public networks, meaning that they use the IP address of a designated VPN service rather than someones public IP address. This allows high-risk users who know they need extra security when their devices are connected to public Wi-Fi networks to hide their activity from prying eyes.
Mullvad acknowledged that there is nothing that the company or anyone else can do to fix the Android leaks if Google doesnt take action to change the OS.
However, there is one Android-based distribution,
GrapheneOS
, that gives users the option to disable connectivity checks within the mobile OS, the researchers said. With this feature enabled in devices using the distribution, Mullvad researchers said they could not observe the connections.
In light of this, the researchers reiterated their position that Google consider adopting this same ability to disable connectivity checks into stock Android, they concluded in their post.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Android Leaks Wi-Fi Traffic Even When VPN Protection Features Are On