Extensive Study on Android VPN Security
Recent research conducted on 281 popular free VPN applications available on the Google Play Store has uncovered significant security concerns. The study, which was presented at the NDSS security conference in February 2026, found that many of these applications fail to provide the privacy and security that users expect from a VPN. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi developed a framework named MVPNalyzer to systematically test these apps.
Alarmingly, the apps identified with at least one security issue have accumulated over 2.4 billion downloads. The vulnerabilities are not complex but rather fundamental, with 29 applications allowing user traffic to bypass the encrypted tunnel, including DNS queries that could expose browsing habits. Additionally, 61 apps were found to transmit some data unencrypted, making it accessible to network eavesdroppers.
Major Flaws Detected in VPN Functionality
One of the most critical security flaws identified involved five apps that download configuration files without encryption. This vulnerability allows attackers on the same network to redirect user connections to malicious servers. Although two of these app providers have pledged to transition to HTTPS for secure file transfers, the others have not yet addressed the issue.
Furthermore, 29 apps were found to leak DNS traffic, and nearly one-fifth of all tested apps used outdated encryption protocols, which significantly weakens user privacy. The research highlights a broader issue of inadequate maintenance and lax security measures among these applications.
Tracking Concerns and Data Privacy
Despite being marketed as privacy tools, many of these VPN apps fail to protect users from tracking. A total of 76 applications were identified as sending the device’s Advertising ID to advertisers, allowing them to track user activity across different apps. Over 80% of the apps contacted known advertising and tracking servers, often sharing device-specific information that could be used to create a unique device fingerprint.
This tracking undermines the primary reason users install VPNs—to avoid surveillance. The study emphasizes that these practices are particularly concerning for users in countries where VPN usage is sensitive or restricted.
Recommendations for Secure VPN Use
Given the security flaws exposed by this study, users are advised to choose VPN providers that have undergone recent independent security audits. Free apps, especially those that are ad-heavy, should be approached with caution. Claims of being “verified” or “no-logs” should be considered as initial indicators rather than guarantees of security.
The MVPNalyzer team plans to make their testing framework publicly available, potentially enabling app stores and regulatory bodies to conduct independent audits. The study calls for greater scrutiny of VPN apps by platforms like Google Play, which currently rely on safety labels that may not reflect the actual security posture of these applications.
As this is an ongoing issue, The Hacker News is seeking responses from Google regarding their review of the flagged apps and has requested confirmation from the MVPNalyzer team on whether the identified vulnerabilities have been addressed by the respective app providers. This article will be updated with any further developments.
