Android Connectivity Service Wi-Fi VPN Side Channel Information Disclosure Vulnerability

A vulnerability exists in the ConnectivityService component of Android, specifically in multiple functions of ConnectivityService.java. This vulnerability allows a Wi-Fi access point to infer which websites a device has visited while connected to a VPN, based on leaked side channel information. The issue could result in remote information disclosure without requiring any additional privileges or user interaction for exploitation. This vulnerability affects several Android versions, including 12, 12L, 13, 14, and 15.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, allowing a Wi-Fi access point to monitor browsing activity of a device connected to a VPN.

Remediation

Users can update their devices to the January 2025 security patch level to address this vulnerability.