I am the author of the post, paper, and app. The findings were reported to Android's Vulnerability Reward Program on May 15, 2026.

The bypass sends a fixed one-byte NAT-T keepalive outside VPN lockdown every 10 seconds to any IP addresses, including most private and reserved ones. The tested packets all reached the router while VPN lockdown was on. I am selling an app to mitigate this VPN leak. Any app with the default Internet permission can bypass the VPN.

The article contains all disclosures and more details. For the full technical analysis, check the paper linked from the blog post.

I am here for about the next two hours and can answer questions.