Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ DevicesTechnical report on Android VPN lockdown bypass via NAT-T keepalive offload.

Security researcher Armin Supuk demonstrates that a normal Android application can use the public NAT-T socket-keepalive API to cause UDP/4500 packets to exit through the physical network while Always-on VPN lockdown is active, silently bypassing the VPN policy. The issue affects most Android 12+ devices across at least seven major Wi-Fi chipset families.

Research · Android · Security · VPN · Networking