A significant vulnerability in Android 16 undermines VPN protections across all applications, allowing user traffic to leak outside the secure VPN tunnel. The “Always-On VPN” and “Block connections without VPN” settings are ineffective, potentially exposing users' real IP addresses. The issue was highlighted by security researcher Yusef, who noted that Google dismissed the problem as “Won’t Fix.” Mullvad VPN also reported the vulnerability, which affects all VPN applications on Android 16. The flaw involves a Binder method on ConnectivityManager that allows an attacker app to leak the user's real IP address without proper permission checks. Current mitigation options are limited and not advisable for average users, with a suggestion to switch to Graphene OS, which has addressed the vulnerability.