GrapheneOS fixes Android VPN leak Google refused to patch

#1

Post by Georgelemental » Sat, May 09, 2026, 2:11 PM UTC

GrapheneOS fixes Android VPN leak Google refused to patch
cyberinsider.com

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#2

Post by unethical_ban » Sat, May 09, 2026, 3:50 PM UTC

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#3

Post by boje » Sat, May 09, 2026, 3:52 PM UTC

unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

That assumes there is pride they have to bother to keep.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#4

Post by OutOfHere » Sat, May 09, 2026, 3:55 PM UTC

[flagged]

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#5

Post by k4rli » Sat, May 09, 2026, 3:57 PM UTC

boje wrote: post #3

unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#6

Post by idovmamane » Sat, May 09, 2026, 3:59 PM UTC

The technical detail that makes this egregious is that the leak happens in system_server, a privileged process. Android’s own lockdown mode explicitly promises that no traffic bypasses the VPN. When the system itself sends the packet over the physical interface, that promise is broken at the kernel level, not in userspace. Calling this “not security bulletin class” is hard to defend.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#7

Post by nottorp » Sat, May 09, 2026, 4:08 PM UTC

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions

So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#8

Post by mcraiha » Sat, May 09, 2026, 4:08 PM UTC

k4rli wrote: post #5

boje wrote: post #3

Earlier quoted context omitted.

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

There should be at least one Motorola phone before end of the year that has GrapheneOS support.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#9

Post by oceansky » Sat, May 09, 2026, 4:14 PM UTC

k4rli wrote: post #5

boje wrote: post #3

Earlier quoted context omitted.

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

So far. Other companies surely will make their devices compatible if the market share increases for it

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#10

Post by snapplebobapple » Sat, May 09, 2026, 4:26 PM UTC

k4rli wrote: post #5

boje wrote: post #3

Earlier quoted context omitted.

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.