- Researchers took a closer look at 281 popular Android VPN apps and found a lot of big security and privacy issues.
- Out of all those apps, 29 actually leaked your internet traffic, another 61 either sent sensitive data without any encryption or handed over device identifiers to third parties, basically breaking the privacy protections they claimed to offer.
- 80% of the apps analyzed contacted advertising and tracking servers known for collecting user data.
People rely on VPNs for privacy protection, but a new study suggests many Android VPN apps may not deliver that protection. Researchers from the University of New Mexico, the University of Michigan, and IIT Delhi built an automated VPN auditing tool they referred to as MVPNalyzer.
They tested 281 free Android VPN apps downloaded from the Google Play Store and found that apps with at least one security flaw have been downloaded more than 2.4 billion times. Their findings were presented at a major cybersecurity event, the Network and Distributed System Security Symposium 2026.
VPN Traffic Leaks Defeat Their Main Purpose
The MVPNalyzer framework evaluates VPNs across multiple layers, checking whether applications:
- Adequately route traffic through secure tunnels.
- Protect communications with robust encryption.
- Secure VPN configuration files.
- Prevent information leaks.
- Avoid sending sensitive user information to third parties.
- Resist simple VPN detection and blocking techniques.
One of the most alarming discoveries involved traffic leaks. The researchers found that 29 VPN apps allowed some internet traffic to bypass the encrypted tunnel. In many cases, DNS requests leaked outside the tunnel. This exposed which websites users were visiting.
Several apps also leaked browser traffic itself, which defeats one of the main reasons people install a VPN. Also, the researchers identified 61 apps that transmitted data without any encryption. Even more concerning, five VPN apps downloaded sensitive VPN configuration files over unencrypted connections.
This creates a serious vulnerability. Hackers on the same public Wi-Fi network can hijack and modify such files. This is a possible attack which will redirect all the users’ traffic through the malevolent servers of the Virtual Private Network, unbeknownst to the users. The scientists managed to build the attack and confirm its success on the phones that were under their control.
Privacy Promises don’t Always Match Reality
The research also raised major privacy concerns. Although VPN providers often advertise anonymous browsing, the study found otherwise. Seventy-six VPN applications transmitted Android Advertising IDs and other device information to third parties. These identifiers can track users across multiple services. They build long-term device profiles.
Many apps also sent additional device characteristics. These included phone model, operating system version, and screen size. On their own, each piece seems harmless. But combined, they form a “fingerprint.” This fingerprint can single out one specific device. One app even sent the phone’s exact GPS coordinates.
Another finding showed that 246 applications contacted the identified advertising and tracking services. This suggests that many VPN providers marketing themselves as privacy solutions actually collect user data.
This disconnect between promised privacy and actual behavior mirrors a recent discovery involving a popular Chrome ad-blocking extension, which security researchers found could execute arbitrary JavaScript on any website.
Many VPNs Don’t Have Good Security Practices
The researchers analyzed configuration files from 108 VPN apps running OpenVPN. The results were striking. Only one of the 108 apps fully implemented recommended encryption and authentication practices. The other 107 failed in some way.
Many relied on outdated encryption settings. Some used weak authentication methods. Others had incomplete security configurations. These kinds of weak practices defeat the purpose of using a VPN as a secure tunnel when accessing the internet.
About one out of every five apps relied on weak, outdated encryption, stuff like Blowfish or Triple DES. These findings are troubling because they really cut down the security of the VPN tunnel. Both of these have known vulnerabilities.
Meanwhile, more than 60% of all tested VPN apps lacked basic application hardening measures. These measures help defend software against tampering and reverse engineering.
The researchers also checked out 169 other apps and found that none of them could properly hide VPN traffic from basic detection methods. So, it’s pretty easy for networks or governments to spot and shut these apps down.
The Implication of these Findings for VPN Users
The discoveries from this study don’t imply that the technology itself is flawed. It only indicates that not all apps claiming to be a VPN are equal in terms of their security.
Security professionals advise using those providers who have an independent security audit available. Look for apps that maintain strong encryption standards and use modern VPN protocols.
Also check that providers clearly explain their privacy practices. Users should keep VPN apps updated. And remember, a VPN does not automatically guarantee anonymity.
According to the researchers, the innovative tool MVPNalyzer has been developed to help enhance transparency in the VPN industry. Dr. Roya Ensafi has pointed out that a lot of people use VPNs for the purpose of privacy, but do not know what is happening behind the scenes with these services.
With the help of MVPNalyzer, different actors will be able to reveal existing risks that otherwise would have stayed in the background. With the recorded increase in the number of VPN users around the world, the conducted study should serve as a warning regarding the fact that trust must be earned, not promised.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
Firefox Users on iOS Can Now Block Ads without an Extension
Mozilla is slowly rolling out a built-in ad blocker for Firefox on iPhones and iPads, no extension n...
Suspected Chinese Hackers Exploit Critical VMware vCenter Flaw Across 47 Countries
Several servers across 47 countries record a compromise via an exploit of Vmware vCenter directory-t...
WhatsApp Tests On-Device Scam Alert without Reading User Messages
WhatsApp is testing a new tool called Scam Alert that spots scam messages right on your phone. The t...
Apple Faces Lawsuit Over Claims that iCloud Private Relay Leaks User IP Addresses
A law firm sued Apple, saying its Private Relay tool did not protect user privacy as promised. Exper...
Hackers Exploit TrueConf Servers to Distribute Malware Through Fake Software Updates
A hacker group named Head Mare broke into TrueConf video meeting servers and swapped safe installers...
New NatJack Attack Exposes Hidden Weakness in How Networks Handle Internet Connections
Security researcher Malcolm Stagg has uncovered NatJack, a new class of attacks that exploits a fund...
