Low severity2.2NVD Advisory· Published May 9, 2026· Updated May 13, 2026

CVE-2026-45182

Description

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GrapheneOS/GrapheneOSllm-create
Range: <2026050400

Patches

Vulnerability mechanics

References

cyberinsider.com/grapheneos-fixes-android-vpn-leak-google-refused-to-patch/nvd
grapheneos.org/releasesnvd
lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypass/nvd

News mentions

No linked articles in our index yet.

cvss	0.143
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000