Researchers audited 281 free Android VPNs: most track you, dozens leak your data

A team of academic security researchers has audited 281 free Android VPN apps from the Google Play Store and found that the majority put users at risk rather than protecting them. Using a purpose-built analysis framework called MVPNalyzer, the researchers documented apps that transmitted data in plaintext, leaked traffic outside the encrypted tunnel, shipped weak or absent encryption, and — in the overwhelming majority of cases — quietly contacted advertising and tracking servers. The findings, presented at the NDSS security conference, are a pointed reminder that a "free VPN" is often anything but private.

What the researchers found

MVPNalyzer inspects a VPN app's behavior across multiple network layers — what it encrypts, what it leaks, how it authenticates, and who it talks to. Across the 281 apps, the picture was consistent: security guarantees that these apps advertise frequently did not hold up in testing. The single most alarming category involved five apps that transmitted their VPN configuration file unencrypted. Because that file specifies which server the app connects to, an attacker positioned on the network could tamper with it and redirect a user's supposedly private traffic — an attack the researchers describe as tunnel hijacking.

• Plaintext data: 61 apps transmitted user data without encryption.
• Traffic leaks: 29 apps leaked traffic outside the VPN tunnel — 24 leaking DNS requests, between them installed 360 million times; 6 leaking full browsing traffic across apps with 54 million installs; and 4 running "tunnels" that weren't encrypted at all. The paper names every one of them in its own table.
• Tracking: 76 apps sent the device Advertising ID, 38 sent the device's IP address, and one transmitted precise GPS coordinates. In total, 246 apps — over 80% of those studied — contacted 3,714 unique advertising and tracking URLs.
• Weak crypto: of 108 apps carrying an OpenVPN configuration file, exactly one followed every security best practice the researchers checked. 88.8% relied on a single authentication method rather than combining a password and a certificate, and 18.5% used weak encryption — including apps defaulting to Blowfish (CVE-2016-6329) and one explicitly selecting Triple DES (CVE-2016-2183). Eight apps set the cipher to "none."
• No obfuscation: 169 apps made no effort to disguise VPN traffic, making them trivial to detect and block.

Why "free" is the common thread

Running a VPN service costs money — servers, bandwidth, and engineering. When an app gives that away for free, the revenue usually comes from somewhere else, and the study's tracking findings suggest where: the apps that contacted advertising and tracking infrastructure were monetizing the very browsing activity a VPN is supposed to conceal. That doesn't make every free VPN malicious, but it does mean a free, unvetted app is precisely the wrong tool for privacy — you may be handing your traffic to more parties, not fewer.

What you should do about it

• Audit what you have installed. If you're running a free VPN you can't name the company behind, assume it offers little real protection.
• Know what a VPN does and doesn't do. It encrypts traffic and hides your IP — it is not antivirus and won't stop tracking cookies or malware. See our explainer on what a VPN does not protect you from.
• Prefer independently audited, paid or reputable-free providers with a published, tested no-logs policy over an anonymous free app. Our guide to choosing a safe VPN covers what to look for.
• Check for DNS leaks after connecting — a VPN that leaks DNS is broadcasting the sites you visit. See our explainer on what a DNS leak is.

The bottom line

The takeaway from MVPNalyzer isn't that VPNs don't work — it's that the label is carrying a lot of unearned trust. The researchers say they disclosed the most exploitable findings to the providers involved, and they have said they intend to release the tool publicly, which would let users and journalists spot-check apps for themselves; the stated timeframe was mid-August 2026, and we could not confirm the release had happened at the time of writing. Until it does, the safest assumption about a free, unknown VPN is that it is not protecting you the way it says it is. If privacy is the goal, choose the provider deliberately rather than by whichever app ranks first in a store search.

Sources

• NDSS Symposium — MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs
• Research Paper PDF (NDSS 2026)
• The Hacker News — Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking
• University of Michigan Engineering / CSE — Mobile VPN security is not as strong as advertised