Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-10 | 3 | Disclosure3 |
| 2026-05-12 | 1 | Disclosure1 |
| 2026-05-13 | 1 | Patch1 |
@alghali تستطيع معالجة الثغرة CVE-2026-45182 عن طريق أداة ADB adb shell device_config put tethering close_quic_connection -1 وثم adb reboot
Post summary
The post announces a workaround for CVE‑2026‑45182 using an ADB command, without providing exploit details or evidence of active exploitation.
An Android app can leak the device's real IP and roughly a kilobyte of arbitrary data outside an active VPN tunnel. CVE-2026-45182 abuses registerQuicConnectionClosePayload on the ConnectivityManager system service. An app registers a byte buffer and a UDP socket. When the socket closes, system_server sends the payload. Running as system UID, system_server is exempt from VPN routing - no VPN-aware check enforces tunneled egress, so the data exits on the physical Wi-Fi or cellular interface. Works even with Always-On VPN and Block connections without VPN enabled. Affected: Android 16 QPR1 and later, from tag android-16.0.0_r3. Discovered by @cybaqkebm. Writeup: "The Tiny UDP Cannon: An Android VPN Bypass" at http://lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypass. Reported to Android VRP on April 12. Closed "Won't Fix (Infeasible)" and "Not Security Bulletin Class" on April 18. Appeal citing CVE-2023-21383 denied April 24. GrapheneOS shipped a patch in their May 4 release. Mitigation on stock Android requires adb: adb shell device_config put tethering close_quic_connection -1 adb reboot The setting persists across reboots but may need reapplying after a system update. A system service built for graceful QUIC teardowns becomes the leak path.
Post summary
The post announces CVE-2026-45182, details how it abuses QUIC connection closure to leak data outside VPN, provides a PoC link, and offers both a patch from GrapheneOS and an adb‑based workaround.
🚨*CVE* CVE-2026-45182 GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, bec… https://www.cve.org/CVERecord?id=CVE-2026-45182 ----- Traducción: CVE-2026-45182 Gra… http://infoflow.cloud`
Post summary
The text announces the discovery of CVE-2026-45182, highlighting its exploitation potential to expose VPN users' real IP addresses, without providing PoC, exploit, patch, or reports of active exploitation.
CVE-2026-45182 GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, bec… https://www.cve.org/CVERecord?id=CVE-2026-45182
Post summary
The text announces a newly disclosed vulnerability in GrapheneOS that lets attackers infer a VPN user's real IP address through a specific optimization; no exploit code, patch, or active exploitation is mentioned.
CVE-2026-45182 GrapheneOS VPN IP Address Disclosure via QUIC Connection Close Payload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45182 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A new CVE (CVE-2026-45182) has been announced, noting an IP address disclosure in GrapheneOS VPN via a QUIC connection close payload, with links to vulnerability details and a notification alert.