Mullvad Android 16 VPN Leak
Quick answer
An Android 16 bug lets apps send some QUIC traffic outside any VPN tunnel, even with Always-on VPN and 'Block connections without VPN'. Google marked it won't fix; Mullvad's workaround is an ADB command that disables the feature, and GrapheneOS has patched it.
Most likely fix: Apply Mullvad's ADB workaround
How to fix it
Try these in order — the most common fix is first.
1. Apply Mullvad's ADB workaround
- Enable Developer options and USB debugging on the phone
- Connect to a computer with ADB installed
- Run: adb shell device_config put tethering close_quic_connection -1
- Run: adb reboot
- Repeat after major system updates, which may undo it
Did this fix it?2. Use GrapheneOS on Pixel
- GrapheneOS release 2026050400 and later disable the vulnerable feature
Did this fix it?3. Limit sensitive use on Android
- Only install trusted apps until Google ships a fix
- Use a desktop for sensitive activity
Did this fix it?
Symptoms
No visible symptom: your real IP can be exposed to a malicious app's server while the VPN appears connected.
Why it happens
- Android 16's QUIC connection-close feature (registerQuicConnectionClosePayload) sends packets outside the VPN
- Affects all Android VPN apps, not only Mullvad
This guide also covers
- mullvad android leak
- android 16 vpn leak
- mullvad android 16
- mullvad ip leak android
Still not working?
If Mullvad VPN keeps failing, you're not alone. See every Mullvad VPN problem users report or the alternatives people switch to.
Need a custom web app or internal tool? Our small team builds it, on your domain or hosted by us. Price agreed together.
Get a quote