When a fork fixes what Google won't: the GrapheneOS VPN leak and what it says about Android
If you use a VPN on your Android phone, you probably assume that flicking the switch in Settings means every byte of network traffic gets routed through the encrypted tunnel. That's the whole point. So it was a small but uncomfortable shock this week when a security audit confirmed what privacy researchers had quietly suspected: under certain conditions, Android leaks traffic around the VPN — and Google has decided it isn't going to patch the behaviour.
The fix, instead, has come from GrapheneOS, the privacy-hardened Android fork that has spent the last few years quietly turning into the de facto reference build for paranoid power users. That's a familiar pattern by now, and it's worth pausing on. Independent forks keep finding — and fixing — gaps that the world's biggest mobile OS vendor either can't or won't address. For ordinary users, that raises a bigger question than any single bug: how much should you trust stock Android with your privacy?
What the VPN leak actually is
According to reporting from TechRadar, CyberInsider and HotHardware, the issue is a traffic leak that bypasses VPNs at the OS level. In other words, even with Android's built-in "Always-on VPN" and "Block connections without VPN" toggles enabled — the very settings designed to prevent leakage — some packets can escape the tunnel and reach the network in the clear.
That's significant for two reasons. First, it undermines the threat model people use VPNs for in the first place: hiding their IP address from a destination, masking metadata from a network operator, or — for journalists, activists and dissidents — keeping their location obscured. Even a small amount of leaked traffic is enough to deanonymise a user. Second, the leak isn't a third-party app misbehaving; it's behaviour baked into the platform itself.
GrapheneOS confirmed it has shipped a patch for the issue in its own builds. Google, per the same reporting, has decided the underlying behaviour is working as intended and won't be fixed in mainline Android. That's not a security "oversight" so much as a deliberate product decision — which is arguably more telling.
Why Google might shrug — and why GrapheneOS won't
Google and GrapheneOS are not solving the same problem. Google is building an operating system for billions of users, OEMs and carriers, balancing battery life, app compatibility, captive-portal logins on hotel Wi-Fi, emergency services connectivity, and the sprawling demands of Google Play Services. Some traffic genuinely has to flow outside a VPN tunnel for the device to function the way users expect — connectivity checks, for instance, or specific carrier services.
The trouble is that those carve-outs become an attack surface. If "working as intended" includes packets that ignore your VPN's block, then "intended" and "private" are no longer the same thing. GrapheneOS, by contrast, has a much narrower remit: harden Android for users who explicitly want privacy and security over every other consideration. When the two goals collide, GrapheneOS picks privacy. Google, understandably, often doesn't.
This isn't the first time the gap has been visible. GrapheneOS has historically led on hardened memory allocators, tighter permission controls (including network and sensor permissions you can revoke from individual apps), per-profile contact and storage scoping, and faster delivery of upstream security patches. The VPN bypass is just the latest entry on a long list of fixes that arrive in the fork before — or instead of — the mothership.
What this means in practice for Australian users
For most people in Australia, the practical risk from this specific leak is modest. If you're using a VPN to bypass geo-blocks on streaming services or to add a layer of comfort on dodgy café Wi-Fi, occasional leaked packets are unlikely to ruin your day. The traffic that leaks tends to be system-level, not your banking session.
But there are cohorts where it matters a lot:
- Journalists and their sources, particularly those reporting on national security or organised crime.
- Domestic violence survivors who rely on technical anonymity to keep a former partner from locating them.
- Activists and protesters whose threat model assumes a hostile network operator.
- Anyone covered by Australia's mandatory data retention regime who is using a VPN specifically to keep metadata away from their telco.
For those users, "the VPN mostly works" isn't good enough. And that's the constituency GrapheneOS has always been built for.
Should you switch to a privacy-focused Android fork?
The honest answer is: probably not, unless you know why you'd want to. Switching to GrapheneOS — or alternatives like CalyxOS or DivestOS — has real costs. You'll need a supported device (GrapheneOS only officially backs Google's own Pixel line, ironically, because of its hardware security features). You'll lose the convenience of factory Google Play Services, although GrapheneOS now offers a sandboxed version that runs Play apps without giving Google privileged system access. Some banking apps, payment apps and DRM-locked streaming apps may refuse to run, or run with limitations.
What you gain is a fundamentally different posture. The OS treats Google as just another app. Network and sensor permissions are granular and revocable. Security patches arrive quickly. And — as this VPN fix demonstrates — when a meaningful leak shows up, someone is willing to plug it.
For most readers, a more proportional response is to take the news as a useful prompt:
- Check that Always-on VPN and Block connections without VPN are both enabled if you rely on a VPN for privacy rather than just streaming.
- Use a reputable VPN provider that publishes audits — the OS leak is one risk, but a shady provider is a much bigger one.
- Audit which apps actually need network access. Android's per-app network controls have improved, even on stock builds.
- If your threat model is serious, treat your phone as the weak link it is, and consider whether GrapheneOS on a Pixel is the right tool for the job.
The bigger lesson: forks as a check on platform power
Whatever you decide about your own device, the GrapheneOS patch is a small but instructive case study in why open-source forks matter. Android is technically open source, but in practice it's overwhelmingly shaped by Google's product decisions, its commercial relationships with OEMs, and its desire not to break the long tail of apps and services that depend on existing behaviour. Those incentives don't always line up with users' privacy interests.
Forks like GrapheneOS exist because someone, somewhere needs to make a different trade-off. They won't replace mainstream Android, and they shouldn't have to. But every time they ship a fix that Google passes on, they put pressure — however polite — on the world's most-used mobile platform to do better. That's a feature of the ecosystem worth defending, even if you never install one yourself.
The next time a security researcher discovers something awkward about how your phone routes traffic, you might not be a GrapheneOS user. But you'll quietly benefit from the fact that someone is.