‘Won’t Fix’—All VPN Apps Affected As Google Android 16 Leaks Info

InnovationCybersecurity‘Won’t Fix’—All VPN Apps Affected As Google Android 16 Leaks InfoByDavey Winder,Senior Contributor.Forbes contributors publish independent expert analyses and insights. Davey Winder is a veteran cybersecurity writer, hacker and analyst.Follow AuthorMay 14, 2026, 09:33am EDT--:-- / --:--This voice experience is generated by AI. Learn more.This voice experience is generated by AI. Learn more.Google Android 16 bug leaks info from all VPN apps.SOPA Images/LightRocket via Getty ImagesA security researcher has published a technical paper detailing how Android 16 has introduced a bug that essentially bypasses VPN protections, affecting all VPN apps. Whether you have enabled the “Always-On VPN” or “Block connections without VPN” settings is immaterial; Android 16 can still leak traffic outside of the VPN protected tunnel. This means that your real IP address is visible on the internet, with all the potential for tracking and surveillance issues that come with it. But here’s the kicker: the researcher reported the bug through the Android Vulnerability Reward Program only for Google to close the issue and mark it as “Won’t Fix” for falling outside of the threat model. I approached Google for a statement on Wednesday, May 13, but at the time of publication, none was forthcoming.ForbesGoogle Targets Caller ID Spoofing As Scam Losses Reach $980 Million AnnuallyBy Davey WinderThe Android 16 VPN Vulnerability ExplainedMy attention was drawn to the issue when Yusef, a security researcher based in Zurich who goes by the X handle of @cybaqkebm, posted a simple statement: “Turns out ‘Always-On VPN’ and ‘Block connections without VPN’ features on Android aren't that reliable.” The link in the tweet led me to a highly technical report detailing an Android 16 VPN bypass. The gist of it is that the two settings mentioned, meant to be a hard guarantee that no information will leave your device outside of the established VPN tunnel, are nothing of the sort. Given...