VPN leak - In conjunction with a VPN update

yellow-leaves

gvprtskvni I have the same owner-secondary profile setup but the update didn't change any VPN settings for me.

Lucky you!
May i asked wether the secondary user profile was at rest during the update?

gvprtskvni

yellow-leaves Yes, I don't have any secondary profiles running in the background.

dsdx331

In my case protections were still enabled, but i couldnt connect to vpn after upgrading to 2025.6, whats strange i cannot even rollback to older version due to errors during installation

userofgos

dsdx331 whats strange i cannot even rollback to older version due to errors during installation

Do you mean that you cannot rollback to an earlier version of MullvadVPN?

mullvadupdate

dsdx331

I ran into the same issue as you. I upgraded to Mullvad 2025.6, while connected to Mullvad, and could not re-connect to Mullvad until I rebooted GrapheneOS. I know another GrapheneOS user who ran into this same issue with upgrading from Mullvad 2025.5 to Mullvad 2025.6. Unlike @yellow-leaves, our VPN protection settings didn't change.

I've upgraded the Mullvad app many times in the past. This was the first time the VPN connection couldn't be restored after the upgrade. Something must have changed on GrapheneOS affecting VPN app updates or with the Mullvad app.

This is reproducible for anyone who can look at it.

dsdx331

after rebooting phone i was able to connect again to mullvad vpn, very strange

dsdx331

userofgos yes, even when mullvad was uninstalled

userofgos

dsdx331 an error is expected if there is still an instance of the updated MullvadVPN app on other users (whether secondary or owner) since updating an app in one profile also updates across all profiles.

Do you have still have MullvadVPN installed on any secondary users? If yes, then you'll have to uninstall those as well in order to install the previous MullvadVPN release.

dsdx331

userofgos Thanks for the information, that was probably the cause, because I have it installed on second profile and private space.

GrapheneOS

mullvadupdate

Something must have changed on GrapheneOS affecting VPN app updates or with the Mullvad app.

No, that's not a conclusion you can draw from what happened. It's likely an app or service issue. The app is what was updated and then the problem occurred after updating it.

mullvadupdate

GrapheneOS

Mullvad reached the conclusion that something is wrong at the OS level. Mullvad reproduced this issue on stock OS Android 16 with the Mullvad VPN, Wireguard, and ProtonVPN apps. Others have reported the same issue for GrapheneOS.

Mullvad reported the issue upstream:

https://issuetracker.google.com/issues/441315112

https://github.com/mullvad/mullvadvpn-app/issues/8488

GrapheneOS

yellow-leaves ryrona Other users had a similar issue with Mullvad after updating to their new app version, but no one else is reporting having any leak. It's likely blocking connections without the VPN was already disabled earlier and that the app update had nothing to do with it. This app update would just be when it was noticed that leak blocking was off due to the Mullvad app having a connectivity issue not specific to one person, which doesn't mean the app update or something else turned off leak blocking. It's just when it was noticed.

yellow-leaves

GrapheneOS
I take you don't belive me when i claim that both block Connections without VPN and Always-on VPN where both enabled before the update.

While this stance is regrettable i find it understandable, do you trust the code underlining the leak Protection features (which I'm sure the GOS team has reviewed) or do you trust a random guy on the forum who claims there is a serious issue with it?

All I'm asking is that you keep an open mind, and the next time you read about an issue like this you may take it seriously.

ryrona

yellow-leaves All I'm asking is that you keep an open mind, and the next time you read about an issue like this you may take it seriously.

Oh, I am definitely going to keep an eye open for this. However, it doesn't seem like the Mullvad update in question has been pushed to my device yet. I will disable all sensitive apps prior to updating it, such to be safe. If I don't report back, I didn't observe those toggles disabling themselves.

MetropleX

Never had Mullvad alter OS settings for block connections before but can concur that a couple of Mullvads most recent updates have required a reboot before network was restored.

SovereignCopper

MetropleX Never had Mullvad alter OS settings for block connections before but can concur that a couple of Mullvads most recent updates have required a reboot before network was restored.

I've noticed the exact same thing for Windscribe (also with block connections without VPN enabled): the last 3 times (Jul 24, Jul 28, and Aug 07) I updated the app, I needed to reboot in order to create a connection. I did not see any leaks before rebooting, but I also didn't explicitly search for leaks after the first time this happened.

Perhaps there's something specific to with recent versions of GrapheneOS that prevents WireGuard tunnels to be set up after the VPN app is updated?

I didn't think much of it before, but if it happens again, I'll get some logs.

nashgraph

On WG Tunnel updates didn't change a thing.

ryrona

I also updated Mullvad VPN now, and the VPN stopped working for me too until phone reboot, but leak protection remains enabled and seemingly enforced all the time, as apps weren't able to reach internet until phone reboot.

Might be that something broke in a recent GrapheneOS or AOSP release, and that loaded VPN settings are not cleaned up properly at VPN app restart anymore. I think this warrants looking further into. Should be possible to do relatively easy on a developer build. Just to understand better what is going on and whether there might be security implications or not.

Maybe the serious leak issues appears only then the VPN settings break in a multiple-profiles-using-VPN-apps setup, possibly when different VPN apps are used in different profiles, or when some profiles are shut down when it breaks but later started or such.

I have no ability to look into this myself now, but I add it to my list.

ryrona

MetropleX as I received the same update and without any OS alteration, there is obviously some specific configuration causing this for you.

They do have a pretty unique configuration, they described it above. That is why I wrote:

ryrona Maybe the serious leak issues appears only then the VPN settings break in a multiple-profiles-using-VPN-apps setup, possibly when different VPN apps are used in different profiles, or when some profiles are shut down when it breaks but later started or such.

I still have no possibility to try to reproduce this bug myself, but I do believe there are some good pointers in this thread about what to try.

MetropleX

mullvadupdate thanks for providing this update.

yellow-leaves

I've now reproduce the issue, just like before both of the leak protections where turned on (yes I'm ******* sure) before the update but afterward they all got disabled just like before

This is a serious bug...

MetropleX

yellow-leaves as I received the same update and without any OS alteration, there is obviously some specific configuration causing this for you. To help alleviate the issue it would be fantastic if you could help by reporting it on the issue tracker and being available to provide logs so that it can be investigated further. There is very much a limited amount of action that can be taken if this cannot be reproduced by us without help from competent members of our community who can assist which I hope you'll very much do.