Android bypasses blockade of VPN connections

Those who use a VPN connection (Virtual Private Network) usually have a good reason for it. Google’s mobile operating system Android, however, seems to route connections past the VPN under certain circumstances, even if this was explicitly prohibited in the options.

Android VPN: Not secure despite blockade?

VPN connections offer the possibility of virtually establishing a private (and thus protected) network connection. This allows transmitted data to be protected or the online identity to be disguised.

Those who decide to use a VPN do so for a good reason. Under Android, however, a VPN connection is supposed to be bypassed automatically under certain circumstances, even if you were actually explicitly prohibited from doing so in the settings.

At least that’s what the commercial VPN provider Mullvad reports in its blog. Even if the setting “Block connections without VPN” is selected, Android seems under certain circumstances parts of the traffic unfiltered past the VPN.

Mullvad noticed this during an unspecified audit, which naturally raises security concerns about privacy. The blog states:

“We understand why the Android system wants to send this traffic by default. For example, if there is a captive portal on the network, the connection becomes unusable until the user logs into it.[…] This may lead to security concerns for some users.”

Privacy issue for Android?

Depending on the threat, this could lead to a major privacy problem for Android. In the Android IssueTracker, where problems and bugs with the operating system can be reported, Mullvad has created a corresponding entry.

There and in the blog, they call on Google to introduce the option to disable connection checks in stock Android, as they are already offered in GrapheneOS.

According to Google, no fix is necessary, the feature works exactly as intended (“intended behavior”). Such a feature would not be understandable for most users, so there would not be much demand for such a feature.

Mullvad is now calling for at least an update to the documentation due to this “potential impact on user privacy”. However, Google has not commented further on this.