A new study has found that apps labeled as covered by Android’s Always-on VPN can still send data outside the tunnel, breaking a promise made by the feature. The flaw affects nearly every Android 12+ device.
Experts at F-Droid and IzzyOnDroid found that a public API allows ordinary apps to open a NAT-T keepalive connection, which sends clear, fixed-format UDP/4500 packets directly to the physical router.
How NAT-T Keepalive Works
To set up a NAT-T keepalive, Android apps can use IpSecManager.UdpEncapsulationSocket. That request gets handed off to ConnectivityManager.createSocketKeepalive(), which then sends it through startNattKeepaliveWithFd().
Without any verification of the caller’s identity, the API takes in a file descriptor and resource ID at each stage. A regular app could therefore request that the Wi-Fi keepalive offload path hold onto a NAT-T mapping, while the system never confirms that the app rightfully owns the caller.
NAT-T packets are admitted by the public path without having to follow the caller UID’s current VPN policy. This lets the packets get through to the physical router.
Captures Show the Packets in Action
The team recorded the subject’s behavior across several recording devices. One such device was a Pixel 8 Pro operating on an Android 16 build CP1A.260505.005, which captured the data packets at the shortest possible 10-second interval while Always-on VPN and lockdown remained enabled.
The researchers watched a Samsung SM-F966B running Android 16 reveal one active Wi-Fi slot through a shared public route. They saw a steady router-driven active-slot lease lasting 24 hours and 32 minutes.
Running on an Asteroids A059 with Android 16, the system chose the physical gateway and tracked a single active Wi-Fi slot. No separate packet capture or timing data was gathered for that specific machine.
What the Study Found
An F-Droid/IzzyOnDroid scanner was used to scan 4,679 separate stored Git origins, and it turned up no evidence of Android framework IPsec, IKE, or NAT-T API usage. A manual audit, however, did uncover 73 Android VpnService apps.
Runtime confirmation crossed three OEMs and two confirmed WLAN families. Firmware coverage spanned seven WLAN families representing 91.24% of estimated Android-derived shipments.
The remaining 8.76% of shipments is unresolved.
Why the Trust Model Collapsed
What failed stems from a broken trust model inside startNattKeepaliveWithFd(...). A privileged raw-fd API grew into a public UdpEncapsulationSocket route, with resource checks put in place and then pulled back out.
The admission process no longer verifies the fd/resource pairing or ensures that the original caller UID’s current VPN policy is enforced prior to offload. This division in trust is what causes the issue.
A broad survey of framework permission anomalies in recent Android Automotive access-control research uncovered ConnectivityService.startNattKeepaliveWithFd. While a related keepalive API enforced PACKET_KEEPALIVE_OFFLOAD, the fd-based path was left without such enforcement.
The report documented a permission mismatch but stopped short of tracing the public UdpEncapsulationSocket trust split, the reverted IpSec resource validation, or physical Wi-Fi emission under VPN lockdown.
The Scope of the Exposure
Three device makers are affected by this issue: Pixel, Samsung, and Nothing. The Pixel 8 Pro and Nothing A059 both show the same behavior on Qualcomm hardware, according to the researchers’ confirmation.
This study examined where Android’s NAT-T keepalive offload sits within the larger field of VPN-leak research. Earlier studies have covered routing exceptions, IPv6 and DNS leaks, WebRTC address exposure, VPN client ecosystems, and shared VPN infrastructure failures.
Beyond an app’s ordinary socket send path, Android hands off certain application-triggered packet emission to system_server, a NetworkAgent, a hardware abstraction layer, or firmware. A normal app can reach across that boundary via the public Android-managed path.
The API defines a fixed packet shape, while the caller selects the destination point inside its own limits. When repeated packets travel along that public route, they disclose the physical network’s source address and timing to the destination, even after the user has turned on blocking without the VPN.
What This Means for Users
This flaw breaches lockdown’s rule of keeping a person’s identity hidden from view, yet it does not need command over any extra software placed inside the system. Software built around the tunnel is expected to stop working entirely whenever the protected connection fails, and to refuse giving away its true network identity to anything sitting beyond the tunnel’s wall.
As an app sends a NAT-T keepalive packet along the public path, the device’s source address becomes visible to the physical router. Because the packet’s form stays constant, anyone monitoring the network can spot it.
While Always-on VPN and lockdown were enabled, the researchers captured the packets at the public minimum 10-second interval, revealing that the packets reached the physical router outside the VPN path.
Key Facts Box
- Devices tested: Pixel 8 Pro, Samsung SM-F966B, Nothing A059 (Asteroids)
- Build tested: Android 16, CP1A.260505.005
- Scanner: 4,679 distinct stored Git origins
- Manual audit: 73 Android VpnService apps
- Firmware coverage: 7 WLAN families, 91.24% of estimated Android-derived shipments
- Unresolved: 8.76% of shipments
- Capture interval: Public minimum 10-second interval
- Continuous observation: 24 h 32 min on Samsung SM-F966B
The research identifies exposure to device-class vulnerabilities across nearly all Android 12+ handsets. What remains unknown concerns the 8.76%.
Three original equipment manufacturers and two confirmed WLAN families form the basis for the researchers’ findings. A common Android 12+ framework path, firmware spanning seven WLAN families, and runtime recordings from Pixel, Samsung, and Nothing all support the same conclusion.
A set form defines the packet, while the recipient is picked by the person calling the function. The weakness exists, and it touches many systems at once.
This research serves as a warning about security guarantees resting on APIs that fail to check who is doing the calling. Once verification stops, the protections vanish entirely.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.