- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,512
Google carefully studied the report and decided to leave the gap open.
GrapheneOS closed the hole in Android, because of which the protection of a VPN could bring at the most unpleasant moment. Even with a permanent VPN and a ban on connecting to bypass the tunnel, a conventional application could transfer a real IP address of the device to the outside. Google has received a report on the problem, but decided not to release a fix.
The vulnerability was discovered by a specialist named Yusuf, also known as lowlevel. According to him, the problem affects Android 16 and is associated with a new network stack function, which helps applications correctly complete the QUIC connection when cliffing.
The weak point was in the API that allowed applications with basic INTERNET and ACCESS_NETWORK_STATE to register arbitrary UDP data in system_server. When the UDP socket closed, the preferred system process sent the stored load directly through the physical network interface of the device, rather than through a VPN tunnel.
Due to the advanced network rights system_server, the package did not fall under the restrictions of VPN-routing. As a result, the bypass was triggered even with an active function of blocking connections without a VPN.
Yusuf checked the vulnerability to the Pixel 8 with Android 16, included by the Proton VPN and the lock mode. The test application was able to transfer the actual public IP address of the device to a remote server, although the user’s VPN protection remained on.
According to the author of the report, the implementation of Google took arbitrary data without verification, whether they are correct frames of QUIC CONNECTION_CLOSE, and did not take into account whether the traffic of the original application should go only through a VPN. The Android security team classified the problem as inappropriate for fixing and not related to security bulletins. After the appeal, Google’s position did not change, and public disclosure was resolved on April 29.
GrapheneOS reacted differently and in version 2026050400 disabled the QuericConnectionClonoteSpoyload optimization, thereby eliminating the leakage vector on supported Pixel devices. The same release included May Android Security Updates for 2026, changes to hardened_malloc, Linux kernel updates for Android 6.1, 6.6 and 6.12, fixing CVE-2026-33636 in libpng, new Vanadium builds and enhanced restrictions on dynamic code loading.
For users of the usual Android build, Yusuf described a temporary bypass via ADB with the shutdown of the DeviceConfig closeig_quic_connection flag. This method requires a developer mode and can stop working if Google removes the flag in future updates.
GrapheneOS closed the hole in Android, because of which the protection of a VPN could bring at the most unpleasant moment. Even with a permanent VPN and a ban on connecting to bypass the tunnel, a conventional application could transfer a real IP address of the device to the outside. Google has received a report on the problem, but decided not to release a fix.
The vulnerability was discovered by a specialist named Yusuf, also known as lowlevel. According to him, the problem affects Android 16 and is associated with a new network stack function, which helps applications correctly complete the QUIC connection when cliffing.
The weak point was in the API that allowed applications with basic INTERNET and ACCESS_NETWORK_STATE to register arbitrary UDP data in system_server. When the UDP socket closed, the preferred system process sent the stored load directly through the physical network interface of the device, rather than through a VPN tunnel.
Due to the advanced network rights system_server, the package did not fall under the restrictions of VPN-routing. As a result, the bypass was triggered even with an active function of blocking connections without a VPN.
Yusuf checked the vulnerability to the Pixel 8 with Android 16, included by the Proton VPN and the lock mode. The test application was able to transfer the actual public IP address of the device to a remote server, although the user’s VPN protection remained on.
According to the author of the report, the implementation of Google took arbitrary data without verification, whether they are correct frames of QUIC CONNECTION_CLOSE, and did not take into account whether the traffic of the original application should go only through a VPN. The Android security team classified the problem as inappropriate for fixing and not related to security bulletins. After the appeal, Google’s position did not change, and public disclosure was resolved on April 29.
GrapheneOS reacted differently and in version 2026050400 disabled the QuericConnectionClonoteSpoyload optimization, thereby eliminating the leakage vector on supported Pixel devices. The same release included May Android Security Updates for 2026, changes to hardened_malloc, Linux kernel updates for Android 6.1, 6.6 and 6.12, fixing CVE-2026-33636 in libpng, new Vanadium builds and enhanced restrictions on dynamic code loading.
For users of the usual Android build, Yusuf described a temporary bypass via ADB with the shutdown of the DeviceConfig closeig_quic_connection flag. This method requires a developer mode and can stop working if Google removes the flag in future updates.
