VPN leak - In conjunction with a VPN update

yellow-leaves

So I've been using mullvad as my VPN provider for a few months now and I've never had any issues with leaks before.
Today, however, after an update to mullvad (2025.6) the damms broke as all of me network traffic where exposed directly to the internet through a public hotspot.

As it turns out all of GOS/Android's anti leak features had been disabled after the VPN update.

Protections that where found disabled after update

Settings > Network & Internet > VPN > Mullvad
Always-on VPN and block Connections without VPN where both disabled after the update

Profile: Secondary user profile (was at rest during update)

Update method

Obtanium: manually triggered from Owner profile

Device: Pixel 6a
Build:2025080600

ryrona

yellow-leaves As it turns out all of GOS/Android's anti leak features had been disabled after the VPN update.

This is exactly the kind of thing that absolutely must never happen. Leaking even for a second could put people at risk in very severe danger, as their true IP address might end up in a server log and stay there. The risk of this is not small, since apps such as messenger apps will connect automatically.

Are you absolutely sure the VPN with block all connections outside VPN was enabled before this? Are you absolute certain they were enabled right before the upgrade? How did you notice they were no longer enabled, what caused you to be alerted of this?

This is something we would like to be able to reproduce. Are you able to reproduce it yourself?

GrapheneOS

yellow-leaves ryrona Other users had a similar issue with Mullvad after updating to their new app version, but no one else is reporting having any leak. It's likely blocking connections without the VPN was already disabled earlier and that the app update had nothing to do with it. This app update would just be when it was noticed that leak blocking was off due to the Mullvad app having a connectivity issue not specific to one person, which doesn't mean the app update or something else turned off leak blocking. It's just when it was noticed.

gvprtskvni

Weird. I have the same owner-secondary profile setup but the update didn't change any VPN settings for me.

yellow-leaves

gvprtskvni

gvprtskvni I have the same owner-secondary profile setup but the update didn't change any VPN settings for me.

Lucky you!
May i asked wether the secondary user profile was at rest during the update?

yellow-leaves

ryrona

ryrona This is exactly the kind of thing that absolutely must never happen. Leaking even for a second could put people at risk in very severe danger, as their true IP address might end up in a server log and stay there. The risk of this is not small, since apps such as messenger apps will connect automatically.

I agree, that's the very reason why i posted about this issue even though I'm a bit busy right now.

ryrona Are you absolutely sure the VPN with block all connections outside VPN was enabled before this? Are you absolute certain they were enabled right before the upgrade?

Yes, I'm certain.
The first thing I did after switching providers is to make sure they where both turned on.
Since then the connection has dropped on occasion and an alert letting me know tha the internets being blocked appears.
Also, when manually disconnecting from the mullvad servers the internet connection's been blocked.
I've always had both Always-on VPN and block Connections without VPN enabled for this profile
Before mullvad i used the stock wireguard client for more than three years I never experienced anything like this during that time either.

ryrona How did you notice they were no longer enabled, what caused you to be alerted of this?

I was using a public wifi at the time and as i booted my phone and logged into my owners profile i noticed the internet was being blocked by at that hotspot.
As I'm still using my old VPN provider and the official wireguard in my owners profile as was unable to conveniently switch wg port to avoid the block so i switched to 4g and updated mullvad using obtanium.
As i found this to be somewhat strange i switched to my secondary profile and checked to see that mullvad where able to connected using the public hotspot and that i had a working internet connection
To my surprise i discovered that while i had internet it was from a local ISP!
From there i proceed to check Settings > Network & Internet > VPN > Mullvad and i found that both leak protections had been disabled.

ryrona This is something we would like to be able to reproduce. Are you able to reproduce it yourself?

No, I have not tried to reproduce it.
I'm gonna be frank, right now i simply do not have the time required to do this.

gvprtskvni

yellow-leaves Yes, I don't have any secondary profiles running in the background.

dsdx331

In my case protections were still enabled, but i couldnt connect to vpn after upgrading to 2025.6, whats strange i cannot even rollback to older version due to errors during installation

userofgos

dsdx331 whats strange i cannot even rollback to older version due to errors during installation

Do you mean that you cannot rollback to an earlier version of MullvadVPN?

mullvadupdate

dsdx331

I ran into the same issue as you. I upgraded to Mullvad 2025.6, while connected to Mullvad, and could not re-connect to Mullvad until I rebooted GrapheneOS. I know another GrapheneOS user who ran into this same issue with upgrading from Mullvad 2025.5 to Mullvad 2025.6. Unlike @yellow-leaves, our VPN protection settings didn't change.

I've upgraded the Mullvad app many times in the past. This was the first time the VPN connection couldn't be restored after the upgrade. Something must have changed on GrapheneOS affecting VPN app updates or with the Mullvad app.

This is reproducible for anyone who can look at it.

dsdx331

after rebooting phone i was able to connect again to mullvad vpn, very strange

dsdx331

userofgos yes, even when mullvad was uninstalled

userofgos

dsdx331 an error is expected if there is still an instance of the updated MullvadVPN app on other users (whether secondary or owner) since updating an app in one profile also updates across all profiles.

Do you have still have MullvadVPN installed on any secondary users? If yes, then you'll have to uninstall those as well in order to install the previous MullvadVPN release.

dsdx331

userofgos Thanks for the information, that was probably the cause, because I have it installed on second profile and private space.

GrapheneOS

mullvadupdate

Something must have changed on GrapheneOS affecting VPN app updates or with the Mullvad app.

No, that's not a conclusion you can draw from what happened. It's likely an app or service issue. The app is what was updated and then the problem occurred after updating it.

mullvadupdate

GrapheneOS

Mullvad reached the conclusion that something is wrong at the OS level. Mullvad reproduced this issue on stock OS Android 16 with the Mullvad VPN, Wireguard, and ProtonVPN apps. Others have reported the same issue for GrapheneOS.

Mullvad reported the issue upstream:

https://issuetracker.google.com/issues/441315112

https://github.com/mullvad/mullvadvpn-app/issues/8488

yellow-leaves

GrapheneOS
I take you don't belive me when i claim that both block Connections without VPN and Always-on VPN where both enabled before the update.

While this stance is regrettable i find it understandable, do you trust the code underlining the leak Protection features (which I'm sure the GOS team has reviewed) or do you trust a random guy on the forum who claims there is a serious issue with it?

All I'm asking is that you keep an open mind, and the next time you read about an issue like this you may take it seriously.

ryrona

yellow-leaves All I'm asking is that you keep an open mind, and the next time you read about an issue like this you may take it seriously.

Oh, I am definitely going to keep an eye open for this. However, it doesn't seem like the Mullvad update in question has been pushed to my device yet. I will disable all sensitive apps prior to updating it, such to be safe. If I don't report back, I didn't observe those toggles disabling themselves.

MetropleX

Never had Mullvad alter OS settings for block connections before but can concur that a couple of Mullvads most recent updates have required a reboot before network was restored.

SovereignCopper

MetropleX Never had Mullvad alter OS settings for block connections before but can concur that a couple of Mullvads most recent updates have required a reboot before network was restored.

I've noticed the exact same thing for Windscribe (also with block connections without VPN enabled): the last 3 times (Jul 24, Jul 28, and Aug 07) I updated the app, I needed to reboot in order to create a connection. I did not see any leaks before rebooting, but I also didn't explicitly search for leaks after the first time this happened.

Perhaps there's something specific to with recent versions of GrapheneOS that prevents WireGuard tunnels to be set up after the VPN app is updated?

I didn't think much of it before, but if it happens again, I'll get some logs.

nashgraph

On WG Tunnel updates didn't change a thing.