Android 16 VPN Bypass Lets Malicious Apps Reveal Users Real IP Address

A design flaw in Android 16's ConnectivityManager (registerQuicConnectionClosePayload) allows regular apps with basic permissions to register payloads that system_server may send over the device's physical network interface, bypassing Always‑On VPN and VPN lockdown, leaking the real IP and enabling data exfiltration; researchers demonstrated the issue on a Pixel 8, published IOCs and a temporary ADB mitigation, and reported it to Google's VRP, which declined to fix it.