Android VPN security risks: 281 applications examined

Hung Pham
Jul 14
6 min read

The MVPNalyzer study presented at the 2026 NDSS Symposium examined 281 free Android VPN applications on Google Play. The results showed that 61 apps transmitted unencrypted data, 29 leaked traffic, 76 sent Advertising IDs, and 107 of 108 apps using OpenVPN configurations failed to meet all assessed criteria. The event is not associated with a specific CVE.

VPNs are commonly installed to protect traffic on public Wi-Fi, conceal activity from observers on the network path, or support remote work. However, once a VPN is enabled, users also give the application the ability to observe and route most of the device’s traffic.

The study, conducted by researchers from the University of Michigan, the University of New Mexico, and IIT Delhi, shows that the label “VPN,” a high app rating, or a connected status does not necessarily mean traffic is truly protected. The work was presented at NDSS from February 23–27, 2026, and was widely introduced by University of Michigan Engineering on July 7, 2026

What did the MVPNalyzer study discover?

MVPNalyzer is a framework built to systematically analyze the behavior of Android VPN applications. The platform collects metadata, traffic inside and outside the tunnel, TLS session keys, open sockets, locally stored data, and VPN configuration files.

The researchers about Android VPN security risks used devices running Android 14 to examine 281 active free VPN applications. The analysis focused on five categories of issues: traffic leaks, insecure data transmission, tunnel configurations, the transmission of device information to third parties, and the ability of VPN traffic to be identified or blocked.

The study does not prove that all 281 applications contain the same flaw. One application may appear in several categories of findings, while the reported installation figures represent cumulative installations rather than the number of unique users currently affected.

Which figures are most notable?

The findings show that the issues are not limited to a single technical flaw but span encryption, routing, and privacy.

Finding	Number of applications	Main implication
Transmitted unencrypted data	61	Observers on the network path may be able to read or modify some data
Sent VPN configuration files over unencrypted connections	5	Could allow devices to be redirected to fraudulent VPN servers
Leaked traffic outside the tunnel	29	Included DNS leaks and browser traffic leaks
Contacted advertising or tracking URLs	246	Shows the widespread presence of tracking infrastructure
Sent Android Advertising IDs	76	Supports device tracking across applications and usage sessions
OpenVPN configurations with at least one issue	107/108	Related to cryptography, authentication, outdated directives, or missing hardening

Among the 61 applications that transmitted unencrypted data, MVPNalyzer recorded 10,552 cleartext flows. Of the 29 applications that leaked traffic, 24 allowed DNS queries to bypass the tunnel, six leaked web traffic, and four used unencrypted tunnels; these groups may overlap.

Regarding privacy, 246 applications contacted 3,714 URLs included on advertising and tracking lists. Contacting a tracker does not automatically prove that sensitive data was transmitted, but a separate analysis confirmed that 76 applications sent Advertising IDs, 38 transmitted IP addresses, and one sent precise location data.

How can Android VPN applications fail?

A DNS leak occurs when domain name resolution queries are not sent through the VPN tunnel. Website content using HTTPS may remain encrypted, but an internet service provider, Wi-Fi operator, or observer on the network path may still be able to see which domains the device is accessing.

android-vpn-security-risks — *Android VPN security risks*

A more serious risk arises when an application downloads VPN configuration files over an unencrypted connection. An attacker positioned on the network path, such as someone using the same public Wi-Fi network, could modify the server address in the file and redirect the device to infrastructure under the attacker’s control. The research team verified this tunnel-hijacking scenario on a test device and notified the five affected providers; two responded and committed to switching to HTTPS.

For OpenVPN, only one of 108 applications met all the criteria examined. Among the remaining applications, 96 relied on a single authentication mechanism, 20 had potentially weak cryptographic configurations, and 61 lacked at least one assessed hardening option. The authors noted that server-side configurations may change parameters during connection establishment, meaning the results reflect weaknesses in client configurations rather than proving that every session was exploited.

How could Vietnamese businesses be affected?

The greatest risk arises when employees independently install free VPN applications on personal phones or company devices to access email, Microsoft 365, CRM systems, internal platforms, and sensitive documents. An unapproved VPN can become an intermediary that observes data rather than a layer that protects it.

In BYOD environments, IT departments often do not know which devices have VPN applications installed, what permissions those applications have been granted, or which providers are routing the traffic. Businesses should consider a model that uses MDM and MAM to manage devices, applications, and work data, rather than relying only on written policies.

mdm-mam-model — *The MDM model helps businesses better manage mobile device security when employees work remotely.*

Potential consequences include the exposure of internal domain names, credentials being transmitted through untrusted infrastructure, employee device identification, violations of data-processing policies, and insufficient evidence for investigations after an incident. Personal VPNs may also reduce the visibility of enterprise firewalls, DNS security tools, or network monitoring systems.

What should businesses do immediately?

Businesses do not need to prohibit every VPN, but they must control the providers, configurations, and devices that are permitted.

Inventory the VPN applications installed on company-owned devices.
Require employees to remove free or unapproved VPN applications.
Block access to critical resources from devices that do not meet security policies.
Prioritize providers with clearly identified operators and current independent audit reports.
Test for DNS, IPv6, and routing leaks after every configuration change.
Collect DNS, firewall, endpoint, and identity-system logs to detect abnormal connections.
Reassess BYOD, remote work, and public Wi-Fi usage policies.
Test VPN applications developed internally, purchased as white-label products, or distributed to employees.

Deploying Microsoft Intune for mobile device management can help businesses enforce application allowlists, verify device compliance, separate work data, and revoke access remotely. MDM does not fix vulnerabilities inside a VPN, but it can help prevent unapproved applications from accessing enterprise resources.

The priority is to identify which VPNs are in use, restrict access from non-compliant devices, and replace applications that lack transparency. Businesses must control providers, devices, identities, and network traffic at the same time.

IPSIP’s expert perspective show about android VPN security risks

Root Cause: The underlying weakness is the transfer of trust from an internet service provider to a VPN provider within an ecosystem that lacks continuous verification. Misconfiguration, inadequate maintenance, and advertising-based business models increase risk.

Attack Vector: The primary paths include attackers on the network modifying unencrypted configuration files, traffic bypassing the tunnel because of routing errors, trackers collecting device identifiers, and OpenVPN configurations lacking adequate authentication or hardening.

Business Impact: Businesses may lose data confidentiality, experience reduced monitoring visibility, face difficulties during incident investigations, and encounter legal or reputational risks if customer information is processed through uncontrolled applications.

Lessons Learned: A “connected” icon is not proof of security. A VPN should be only one component of a defense architecture that combines device management, identity controls, network monitoring, and periodic testing.

What can businesses implement about android VPN security risks?

IT departments can create an approved VPN list, apply Conditional Access, block rooted devices, perform regular DNS leak testing, and require audit evidence from providers. Internally developed or white-label applications should undergo gray-box or white-box testing before release.

IPSIP's cybersecurity solutions are appropriate

For BYOD devices or company phones that lack adequate controls, the Microsoft Intune mobile device security service supports centralized policy deployment and restrictions on non-compliant applications.

If a business develops or distributes a VPN application, the Pentest service can examine authentication flows, routing, APIs, configuration files, and real-world exploitability before deployment.

When continuous monitoring of abnormal connections, DNS, firewalls, and endpoints is required, the 24/7 Security Operations Center can provide additional alert-analysis and response-coordination capabilities. A SOC does not replace the need to select a secure VPN, but it can help reduce operational blind spots.

The MVPNalyzer study shows that a VPN does not automatically create a trustworthy communication channel. When an application routes traffic incorrectly, downloads configurations insecurely, or sends device identifiers to third parties, the expected protection layer can become a new source of risk.

For Vietnamese businesses, the priority is to inventory the VPN applications in use, restrict permitted applications, control BYOD devices, and maintain network visibility. Provider selection should be based on audit evidence and technical assessments rather than installation counts or marketing claims.

-------------------------

Frequently asked question

Are all free Android VPNs unsafe?

No. The study identified groups of applications with specific problems and did not conclude that every free VPN is unsafe. Businesses should assess each provider based on audits, configurations, operating models, and management capabilities.

Can users test whether a VPN leaks DNS data?

Users can perform a DNS leak test, but a simple test will not detect trackers, weak cryptographic configurations, or behavior that appears only under certain network conditions. A deeper assessment requires traffic and application-configuration analysis.

Does a Google Play “Verified” label provide an absolute guarantee?

No. A verification label is one reference signal, but the study indicates that app-store information may not fully reflect routing errors, cleartext traffic, or OpenVPN configuration weaknesses.

-----------------------

Referral