CVE-2026-45182CWE-441

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload…

Low · published May 9, 2026

CVSS v3.1
2.2
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00120 · 1.8th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2026-05-09T22:07Z
EPSS history
Timeline
  • 09 MAY 22:07Z
    GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload…
    cvelistv5