A practical look at metadata leakage in mobile VPNs
Most people choose a VPN for one reason: they don't want their internet provider, or anyone sniffing the network, to see where their traffic is going. It's a reasonable expectation. It's also, in practice, harder to guarantee than the marketing suggests.
Over the past quarter our lab ran DNS-leak and traffic-correlation tests against nine widely used consumer VPN clients across desktop and mobile. We found that three clients, under specific network-change conditions such as switching from Wi-Fi to cellular, briefly fell back to the device's default DNS resolver instead of routing DNS queries through the tunnel.
A VPN that leaks DNS during a network transition isn't broken by an attacker — it's broken by design.
The leak window was short, typically under two seconds, but consistent and reproducible. For a user on a hostile network, two seconds is more than enough for an observer to see which domains were resolved.
What we disclosed
We reported the issue to all three vendors under a 90-day coordinated disclosure window. Two have since shipped fixes; the third has acknowledged the report and is targeting a fix in their next release cycle.
What you can do today
If you rely on a VPN for anything sensitive, check whether your client supports a strict "kill switch" that blocks all traffic — not just re-routes it — the moment the tunnel drops or the network changes. Most clients bury this setting; few enable it by default.