Another way to leak traffic on Android has been discovered

The flaw lets any Android app open a keep-alive UDP socket that the Wi-Fi or cellular chip offloads, enabling direct Internet packets on port 4500 and bypassing the “Block all connections without VPN” rule. It exposes the device’s real IP without special permissions; mitigation requires Android system changes, with GrapheneOS developing a fix and Mullvad offering no practical workaround.