A comprehensive new study has cast a harsh light on the security posture of many free Virtual Private Network (VPN) applications available on the **Google Play Store**. Researchers, utilizing a novel testing system dubbed **MVPNalyzer**, found that a significant number of these apps fundamentally fail to protect user privacy and secure their traffic, despite being installed billions of times. The findings, presented at the **NDSS security conference** in February 2026 by a collaborative team from the **University of Michigan**, the **University of New Mexico**, and **IIT Delhi**, highlight basic, rather than sophisticated, security lapses. ### Critical Flaws Uncovered The **MVPNalyzer** system, a mobile counterpart to the earlier **VPNalyzer** study focused on desktop VPN software, is described as the first framework designed for systematically auditing Android VPN apps. Its analysis of 281 popular free VPN applications revealed several alarming issues: * **Data Leaks**: 29 apps were found to leak user traffic outside the encrypted tunnel, including sensitive **DNS** lookups that reveal visited websites. These apps alone account for approximately 360 million installs. * **Plaintext Transmission**: 61 apps sent some data in plaintext, making it readable to any eavesdropper on the network. * **Tunnel Hijacking**: Perhaps the most serious vulnerability, five apps transmitted their configuration files unencrypted. This allows an attacker on the same network (e.g., public Wi-Fi) to intercept and modify the file, redirecting the user's VPN connection to a server controlled by the attacker. The researchers successfully demonstrated this attack.  ### A False Sense of Security Beyond direct data exposure, the study identified other significant shortcomings: * **Lack of Obfuscation**: 169 apps made no attempt to disguise their traffic as anything other than a VPN. This makes them easily detectable and blockable by network operators or government censors, directly contradicting the promises of many apps to bypass restrictions. * **Tracking Despite Privacy Claims**: Despite users installing VPNs for privacy, 76 apps sent the device's **Advertising ID**, a unique identifier used for cross-app tracking. Over 80% (246 apps) contacted known advertising and tracking servers. Some even sent detailed device fingerprints, and one transmitted exact GPS coordinates.  ### Weak Cryptography and Poor Maintenance An examination of the **OpenVPN** configuration files bundled with 108 apps revealed further vulnerabilities: * Only one app followed all measured security best practices. * Approximately 89% relied on a single authentication method (password or certificate) instead of a more robust combination. * Nearly one in five used weak or outdated encryption, including the deprecated **Blowfish** cipher and **Triple DES**. Some even set the data cipher to `none`, effectively disabling encryption entirely. These ciphers are known to be vulnerable (**CVE-2016-6329** and **CVE-2016-2183**). These widespread issues are largely attributed to poor maintenance and inadequate oversight. Many of these problematic apps rank highly in Play Store search results, often bearing **Google's** safety labels and a "Verified" badge, which the study suggests function more as marketing tools than genuine security guarantees.  ### A Recurring Problem This isn't an isolated incident. Previous research echoes these findings: * In August 2025, **Citizen Lab** at the **University of Toronto** and **Arizona State University** uncovered that several popular Android VPN apps, with over 700 million combined downloads, were secretly linked, shared hard-coded passwords, and collected location data. * In October 2025, mobile security firm **Zimperium** reported that three of the roughly 800 free VPN apps it tested still bundled an **OpenSSL** library vulnerable to **Heartbleed**, a bug patched in 2014. Many also requested excessive phone permissions. The consistent narrative across these studies is clear: free VPN apps frequently combine compelling privacy pitches with subpar engineering, reaching millions of users before critical flaws are identified. ### Recommendations for Users Given that the most severe flaws are invisible to the user, the crucial defense lies in scrutinizing the provider, not just the advertised features. * **Prioritize Audits**: Favor VPN providers that publish recent, independent security audits. * **Be Wary of "Free"**: Exercise caution with free apps, especially those laden with advertisements. * **Verify Claims**: Treat "verified" or "no-logs" claims as a starting point for due diligence, not as definitive proof. Users can consult the study's appendix to check if their installed apps are listed among the flagged ones. The research team plans to release **MVPNalyzer** publicly, enabling app stores and regulators to conduct their own security checks – a necessity, according to the evidence presented.