CVE-2026-45182: Low severity GrapheneOS GrapheneOS vulnerability
GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let systemserver transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the setting "Block connections without VPN" (it is explicitly implicated in the issue when enabled).
GrapheneOS VPN Block connections without VPN = enabled - Configuration
Disable the setting "Always-on VPN" (it is explicitly implicated in the issue when enabled).
GrapheneOS VPN Always-on VPN = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45182?
CVE-2026-45182 is classified as a critical severity vulnerability due to the potential exposure of user IP addresses.
How do I fix CVE-2026-45182?
To fix CVE-2026-45182, users should upgrade to GrapheneOS version 2026050401 or later.
What causes CVE-2026-45182?
CVE-2026-45182 is caused by an optimization in registerQuicConnectionClosePayload that allows applications to send UDP traffic, potentially revealing the user's real IP address.
Who is affected by CVE-2026-45182?
CVE-2026-45182 affects users running GrapheneOS versions prior to 2026050400.
What protections are bypassed by CVE-2026-45182?
CVE-2026-45182 bypasses the 'Block connections without VPN' feature, which is intended to protect user IP privacy.