Home

Description

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.

PUBLISHED Reserved 2026-05-09 | Published 2026-05-09 | Updated 2026-05-09 | Assigner mitre




LOW: 2.2CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Problem types

CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

Product status

Default status
unaffected

Any version before 2026050400
affected

References

lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypass/

grapheneos.org/releases

cyberinsider.com/...ndroid-vpn-leak-google-refused-to-patch/

cve.org (CVE-2026-45182)

nvd.nist.gov (CVE-2026-45182)

Download JSON