GrapheneOS fixes Android VPN leak Google refused to patch

GrapheneOS has patched an Android VPN bypass vulnerability that Google declined to fix, which could leak a user's real IP address even with Always-On VPN and lockdown mode enabled. The flaw, discovered by researcher Yusuf, stemmed from a new QUIC connection teardown feature in Android 16's networking stack. Apps with only standard INTERNET permissions could register arbitrary UDP payloads with system_server, which would then transmit them outside the VPN tunnel via the physical network interface. Google classified the issue as 'Won't Fix' and not security bulletin class. GrapheneOS's fix disables the registerQuicConnectionClosePayload optimization entirely. Stock Android users can temporarily mitigate via ADB by disabling the close_quic_connection DeviceConfig flag, though this workaround may not persist.