{"id":245825,"date":"2026-05-14T09:33:00","date_gmt":"2026-05-14T13:33:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/14\/wont-fix-all-vpn-apps-affected-as-google-android-16-leaks-info\/"},"modified":"2026-05-14T09:50:09","modified_gmt":"2026-05-14T13:50:09","slug":"wont-fix-all-vpn-apps-affected-as-google-android-16-leaks-info","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/14\/wont-fix-all-vpn-apps-affected-as-google-android-16-leaks-info\/","title":{"rendered":"\u2018Won\u2019t Fix\u2019\u2014All VPN Apps Affected As Google Android 16 Leaks Info"},"content":{"rendered":"

\u2018Won\u2019t Fix\u2019\u2014All VPN Apps Affected As Google Android 16 Leaks Info<\/a><\/p>\n

https:\/\/www.forbes.com\/sites\/daveywinder\/2026\/05\/14\/wont-fix-all-vpn-apps-affected-as-google-android-16-leaks-info\/<\/a><\/p>\n

Publish Date: 2026-05-14 09:33:00<\/a><\/p>\n

Source Domain: www.forbes.com<\/a><\/p>\n

Google Android 16 bug leaks info from all VPN apps.<\/span><\/p>\n

SOPA Images\/LightRocket via Getty Images<\/p>\n

A security researcher has published a technical paper detailing how Android 16 has introduced a bug that essentially bypasses VPN protections, affecting all VPN apps. Whether you have enabled the \u201cAlways-On VPN\u201d or \u201cBlock connections without VPN\u201d settings is immaterial; Android 16 can still leak traffic outside of the VPN protected tunnel. This means that your real IP address is visible on the internet, with all the potential for tracking and surveillance issues that come with it. But here\u2019s the kicker: the researcher reported the bug through the Android Vulnerability Reward Program only for Google to close the issue and mark it as \u201cWon\u2019t Fix\u201d for falling outside of the threat model. I approached Google for a statement on Wednesday, May 13, but at the time of publication, none was forthcoming.<\/p>\n

Forbes<\/span>Google Targets Caller ID Spoofing As Scam Losses Reach $980 Million Annually<\/span>By Davey Winder<\/span><\/span><\/span><\/p>\n

The Android 16 VPN Vulnerability Explained<\/h2>\n

My attention was drawn to the issue when Yusef, a security researcher based in Zurich who goes by the X handle of @cybaqkebm, posted a simple statement: \u201cTurns out \u2018Always-On VPN\u2019 and \u2018Block connections without VPN\u2019 features on Android aren’t that reliable.\u201d The link in the tweet led me to a highly technical report detailing an Android 16 VPN bypass. The gist of it is that the two settings mentioned, meant to be a hard guarantee that no information will leave your device outside of the established VPN tunnel, are nothing of the sort. <\/p>\n

Given that Google has previously warned about the dangers of malicious VPNs and advised users to \u201conly download VPN apps from official sources, and check for apps with the VPN badge in Google Play,\u201d you might think that this would be something that it would take very seriously indeed. Yet, Yusef has confirmed, after reporting the vulnerability through the Android VRP, \u201capparently, it…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\u2018Won\u2019t Fix\u2019\u2014All VPN Apps Affected As Google Android 16 Leaks Info https:\/\/www.forbes.com\/sites\/daveywinder\/2026\/05\/14\/wont-fix-all-vpn-apps-affected-as-google-android-16-leaks-info\/ Publish Date: 2026-05-14…<\/p>\n","protected":false},"author":1,"featured_media":245826,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/imageio.forbes.com\/specials-images\/imageserve\/6a05c122e19ca51a86e33541\/0x0.jpg?format=jpg&height=900&width=1600&fit=bounds","fifu_image_alt":"","footnotes":""},"categories":[46],"tags":[70,57,27],"class_list":["post-245825","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","tag-google","tag-security","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/245825"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=245825"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/245825\/revisions"}],"predecessor-version":[{"id":245827,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/245825\/revisions\/245827"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/245826"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=245825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=245825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=245825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}