Android 16 VPN bug turns apps installed on your phone into a leaky sink

A newly discovered Android 16 bug can let some app traffic bypass VPN tunnels and reveal a device’s real IP address.

The flaw sits in the ConnectivityManager service and was confirmed by Mullvad to affect all VPN apps.

Google received the report but closed it as not planned to be fixed, leaving the privacy issue unresolved.

The bug weakens VPN protection on Android 16 by potentially exposing users’ location and network identity even when a VPN is enabled.