MVPNalyzer Finds Five Free Android VPN Apps Vulnerable to Tunnel Hijacking via Plaintext Config Files

The University of Michigan, New Mexico, and IIT Delhi team extended their prior VPNalyzer desktop framework into MVPNalyzer, presented at NDSS 2026. Live traffic tests showed 24 apps leaking DNS queries, six exposing full browsing sessions, and four running entirely unencrypted tunnels. Separate static analysis of 108 bundled OpenVPN configs found only one meeting basic security parameters. These failures are architectural, not edge cases, and concentrate in apps promising censorship circumvention while remaining trivially fingerprintable.

Free VPN economics drive the pattern. Developers monetize via advertising IDs and tracking beacons rather than subscriptions, with 246 apps phoning home to known ad domains and 76 transmitting the persistent Advertising ID. One app even exfiltrated live GPS coordinates. The trust shift users accept when installing a VPN is therefore inverted: the app itself becomes the surveillance endpoint, a repeat of the desktop findings but now on devices carrying persistent location and sensor data.

Two of the five hijack-vulnerable providers acknowledged the plaintext config flaw and committed to HTTPS delivery with certificate pinning. Three did not respond. Google Play has not yet removed or updated the affected packages despite the documented attack path. Procurement and incident records from similar past disclosures show regulators move only after independent verification and public pressure, not initial researcher notifications.

Next steps hinge on whether Play Store policy enforcement or carrier-level blocking follows the NDSS publication. Without contract-level mandates on config transport and leak testing, the same cohort of apps will continue shipping with identical flaws.