The leak stems from a flaw in how Android 16 handles QUIC connection shutdowns. According to Mullvad, apps can abuse a system function tied to the Connectivity Manager service to send specific traffic outside the VPN tunnel. This means a malicious app could reveal a user's real IP address to external servers, even if the device is configured to block all non-VPN traffic. Mullvad says the issue affects all VPN apps on Android 16 because the vulnerability exists within the operating system itself. The Sweden-based VPN also noted that GrapheneOS, a privacy-focused Android-based operating system,