Study of 281 Free Android VPN Apps Reveals Traffic Leaks, Unencrypted Data, and Tracking

A comprehensive study of 281 popular free Android VPN apps from the Google Play Store, conducted by researchers at the University of Michigan, the University of New Mexico, and IIT Delhi, has uncovered severe security and privacy flaws. The apps, collectively installed over 2.4 billion times, were tested using a new framework called MVPNalyzer, presented at the NDSS security conference in February 2026.

Key findings include:

• 29 apps leaked user traffic outside the encrypted tunnel, with 24 exposing DNS lookups and 6 leaking full browsing traffic.
• 61 apps transmitted data in plain text, including 5 that sent configuration files unencrypted, enabling tunnel hijacking where an attacker on the same network can redirect traffic to a malicious server.
• 76 apps sent the device’s Advertising ID, and 246 contacted known advertising and tracking servers, undermining the privacy VPNs are meant to provide.
• 169 apps made no effort to disguise their traffic as a VPN, making them easily detectable and blockable by network operators or censors.
• Analysis of OpenVPN configurations in 108 apps found only one followed all security best practices; 89% used a single authentication method, and nearly 20% used weak or outdated encryption, including Blowfish and triple DES, which have known vulnerabilities (CVE-2016-6329 and CVE-2016-2183).

The study highlights that Google Play Store safety labels and the ‘Verified’ badge function more as marketing signals than security guarantees. The researchers have released a list of flagged apps and plan to make MVPNalyzer publicly available for app stores and regulators.