‘Won’t Fix’—All VPN Apps Affected as Google Android 16 Leaks Info

A researcher says Android 16 can send some traffic outside VPN tunnels even when lockdown settings are enabled.

This can expose users’ real IP address and undermine privacy protections across VPN apps.

The issue was reported to Google, but it was closed as “Won’t Fix” because it was considered outside the company’s threat model.

The flaw affects features like Always-On VPN and “Block connections without VPN,” raising concerns about tracking and surveillance.