GrapheneOS fixes Android VPN leak Google refused to patch

> Google maintained its position, authorizing public disclosure on April 29.

I'm surprised they honored the embargo at that point, and delayed the fix until May. Why not just release immediately?

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions

So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Stock Android is spyware and adware, back in the day we called such software malicious and removed it, now it's the default.

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

[dead]

It wasn't patched by Google because it's a backdoor. For various reasons, modern mainline Android is substantially hazardous to use.