GrapheneOS CVE-2026-45182

Exploitation requires three specific preconditions be met simultaneously: (1) the user has enabled both 'Block connections without VPN' AND 'Always-on VPN' settings in Android's VPN configuration menu, (2) a malicious or compromised application with local code execution capability is installed on the device and has the ability to invoke registerQuicConnectionClosePayload system calls, and (3) the attacker must trigger the vulnerable code path, which occurs during QUIC connection close events and requires either crafted network conditions or specific application state manipulation (AC:H). The vulnerability does NOT affect users with only 'Block connections without VPN' enabled (without Always-on VPN), does NOT affect systems using non-QUIC protocols, and does NOT affect uncompromised applications that do not invoke this optimization. Authentication to the system is NOT required because the exploit operates from a local app with standard user privileges (PR:L), but user interaction may be required to allow the app to reach the vulnerable code path (UI:R).

This vulnerability presents a moderate information security risk masked by a very low CVSS score (2.2). The CVSS vector (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) correctly captures that exploitation requires local access, low privileges, high complexity, and user interaction with only confidentiality impact limited to the user's scope. However, the real-world risk is higher for targeted users: VPN leakage directly contradicts the security model users assume when enabling 'Block connections without VPN' and 'Always-on VPN' settings. The vulnerability is not actively exploited (no KEV listing), but a proof-of-concept exists via the published blog post link (lowlevel.fun), indicating technical feasibility. The high AC:H rating suggests attackers must craft specific QUIC close conditions or application states, reducing widespread exploitation probability. For users with sensitive threat models (journalists, activists), IP leakage is a critical privacy breach despite low CVSS; for typical users, the combination of required local access and high complexity limits practical risk. No EPSS score provided, but threat modeling suggests this is a targeted rather than mass-exploitation vulnerability. The disconnect between CVSS and real privacy impact illustrates why CVSS alone is insufficient for VPN security decisions.

An attacker with local access to an Android device (via social engineering, physical access, or prior compromise) installs a malicious application. The user has enabled 'Block connections without VPN' and 'Always-on VPN' settings, believing their traffic is fully protected. The malicious app crafts a QUIC close payload and triggers the registerQuicConnectionClosePayload method, requesting that system_server send UDP packets to a remote server controlled by the attacker. Because system_server operates outside per-app VPN routing, the UDP packets bypass the VPN tunnel and reveal the device's real IP address to the attacker's server, which logs it. The user believes they are anonymized via VPN, but the attacker has acquired their true IP address.