Android VPN lockdown leaks your real IP through NAT-T keepalive offload

Android’s “Always-on VPN” plus “Block connections without VPN” is supposed to guarantee that a covered app’s traffic fails closed when the tunnel isn’t available. New research shows an ordinary, unprivileged app can punch through that guarantee using Android’s public NAT-T socket-keepalive API. By opening an IpSecManager.UdpEncapsulationSocket and asking ConnectivityManager to keep the NAT mapping alive, the app hands a completed UDP/4500 keepalive packet to the Wi-Fi hardware offload path, which emits it directly to the physical router — outside the VPN, and without the app ever waking to send each packet.

The root cause is a collapsed trust model in startNattKeepaliveWithFd(). A once-privileged raw file-descriptor interface was opened up into a public path; resource validation was added and then reverted, so admission never verifies that the caller actually owns the fd/resource pair, nor does it re-check the calling UID’s current VPN-lockdown policy before offloading. Because emission happens below the socket layer that lockdown normally polices, the tunnel confinement is simply bypassed. The leak doesn’t require arbitrary payload control — the packet shape is fixed — but the repeated fixed-interval packets disclose the device’s real physical-network source address and timing to whatever destination the app chooses.

The author backs this with runtime evidence on three vendors running Android 16: a Pixel 8 Pro capture recorded the UDP/4500 packets at the 10-second minimum interval with lockdown on, a Samsung foldable held a router-directed active-slot lease for over 24 hours, and a Nothing phone confirmed the same admission path on a third OEM. Given the shared Android 12+ framework and firmware coverage spanning WLAN families behind roughly 91% of Android shipments, the paper argues most Android 12-and-later devices are exposed. A scan of 4,679 F-Droid repositories found essentially no legitimate use of these NAT-T APIs, suggesting little would break if the platform tightened admission.