Virtual Private Networks (VPNs) are widely used to protect online privacy by encrypting internet traffic and hiding users’ identities from websites, internet providers, and other third parties. Because VPN applications handle virtually all of a user’s network traffic, people trust them with some of their most sensitive information. But new research suggests that many mobile VPN apps may not be providing the level of protection users expect.
Researchers have developed a new automated testing framework that systematically evaluates the security of Android VPN applications, revealing weaknesses across a large number of popular services.
The framework, called MVPNalyzer, was designed to analyze VPN behavior at multiple network layers rather than relying on isolated manual testing. It examines whether applications properly route traffic through encrypted tunnels, use secure communication channels, protect sensitive configuration files, prevent information leakage, and avoid exposing user data to third parties.
Using the platform, researchers evaluated 281 widely used Android VPN apps.
The results identified several recurring problems. Researchers found that 29 applications leaked DNS requests or browser traffic outside the encrypted VPN tunnel, potentially exposing browsing activity that users expected to remain private.
They also reported that more than 20 percent of the tested VPNs transmitted certain information without encryption, while more than 60 percent lacked basic security hardening measures designed to protect the applications themselves from attack.
Another notable finding involved user privacy. According to TechXplore, dozens of VPN applications transmitted device identifiers and other information to third parties, enabling user tracking despite marketing claims centered on anonymity.
The researchers also examined VPN configuration files where available and found that nearly all analyzed applications failed to fully implement recommended encryption and authentication practices, potentially reducing the overall security of the VPN connection.
From a cybersecurity perspective, these findings are significant because VPNs often serve as the first line of defense for remote workers, government personnel, travelers, journalists, and organizations handling sensitive information. If a VPN leaks traffic or transmits data insecurely, it may create opportunities for surveillance, interception, or other cyberattacks rather than preventing them.
The researchers believe the framework could help improve transparency by giving security professionals, regulators, developers, and consumers a standardized method for evaluating VPN security. They also suggest the same approach could eventually be adapted to assess other privacy-sensitive mobile applications, including messaging platforms and health-related services.
The study highlights that while VPNs remain valuable security tools, not every application offering VPN functionality necessarily provides the level of privacy and protection users assume.
The research can be found here.
