Any app on recent Android versions can leak certain traffic

submitted by

https://mullvad.net/en/blog/2026/5/12/any-app-on-recent-android-versions-can-leak-certain-traffic

A recently discovered bug in Android 16 allows any app to leak traffic outside the VPN tunnel.

The bug was reported to the Android Security Team, but was closed as Won’t Fix (Infeasible) […] In contrast, GrapheneOS, a security-focused Android-based OS, quickly patched the issue in its codebase.

A mitigation is possible, but is quite technical in that it requires USB debugging to be enabled on the device in order to run the following Android Debug Bridge (adb) commands:

adb shell device_config put tethering close_quic_connection -1

adb reboot

17
34
2

Log in to comment

Hot Top New Old

In contrast, GrapheneOS, a security-focused Android-based OS, quickly patched the issue in its codebase.

Good that I use GrapheneOS.

 reply
5

Comments in Technology@lemmy.world

LOL if that’s the fix and the Android Security team won’t fix it… jfc what a joke

I have a bunch of android based barcode scanners at work that we have to use adb to do some of the configuration setup. it’s a powerful tool but it’s not rocket science or anything more complicated than command line stuff

 reply
51

They won’t fix the thing because they’re ordered to do so. It’s not a bug, it’s a feature.

 reply
32

Fixed in GrapheneOS fwiw

 reply
16

It’s not a bug, it’s a feature.

They’ve copied gOS’s homework one hell of a lot. They clearly don’t want to do so here.

 reply
8

This disables the QUIC graceful shutdown feature, and thus closes the leak. The mitigation will persist across reboots, but it may be undone by system updates, in which case the steps will need to be repeated.

Performing this mitigation means that the server-side QUIC socket will remain half-open until it times out, which should generally not negatively affect the Android device or apps running on it. However, only use the command at your own risk if you understand the implications.

does anyone know what are the implications of the fix proposed?

 reply
14

It makes it harder to run big servers talking to android apps. Instead of them saying “I’m done, goodbye” they will just ghost the server. Then the server has to keep a connection open and waiting around to hear from you again even though you are done.

This isn’t a problem if a few people do it, but if everyone does it then servers could end up spending more time waiting on abandoned connections than doing real work.

 reply
14

Well now I’m definitely doing it

 reply
5

Hope Lineage and /e/OS implement the fix soon as well

 reply
6

However, at the time of writing the issue is marked as inaccessible by Google for unknown reasons.

“Don’t be evil”

 reply
5
edited

Isn’t QUIC long gone, merged into HTTP/3?

 reply
1

Comments in Technology@lemmy.zip

edited

Yeah, haha sure, a bug… 🙄

 reply
20

“We’re sorry” ((rubs nips))

 reply
7

ahh and it always seems somehow related back to QUIC!

 reply
2
edited

nice, gonna use the fix as soon as I get home.

EDIT:

This disables the QUIC graceful shutdown feature, and thus closes the leak. The mitigation will persist across reboots, but it may be undone by system updates, in which case the steps will need to be repeated.

Performing this mitigation means that the server-side QUIC socket will remain half-open until it times out, which should generally not negatively affect the Android device or apps running on it. However, only use the command at your own risk if you understand the implications.

anyone knows the implications of this?

 reply
9

My guess is if the server side connection stays half open it would mean the server is still sending data to your device after its closed the connection causing that data to essentially get sinkhole’d.

Maybe in some extreme examples if you have a huge amount of connections that get abruptly closed your bandwidth could be limited until the connections expire. In normal circumstances that probably just means a small amount of additional background resources are getting wasted.

 reply
4

Android 16 introduced a bug

Security via poverty, like I can even run andriod 16 😎

 reply
4
Insert image