People turn on VPN expecting complete online privacy, or to bypass restrictions, believing browsing activity is hidden from prying eyes. But what if the very tool designed to protect your data is quietly exposing it instead?
A new cybersecurity study suggests that for millions of users, that possibility may be more real than they think.
Researchers from University of Michigan Engineering found that several popular VPN apps fail to adequately secure users’ internet activity, while some even expose sensitive data through traffic leaks, raising fresh concerns about the reliability of services designed to protect digital privacy.
The findings were presented at the Network and Distributed System Security (NDSS) Symposium 2026, where researchers introduced MVPNAnalyzer, the world’s first automated framework capable of conducting large-scale security assessments of mobile VPN applications.
Using the new tool, the research team analyzed 281 popular Android VPN apps and discovered that 29 apps leaked users’ DNS requests and browser traffic, potentially exposing browsing activity despite the VPN being enabled. Such leaks defeat one of the primary reasons people use VPN services: keeping their online activity private.
The study revealed broader security shortcomings across the VPN ecosystem. More than 20% of the apps transmitted internet traffic without proper encryption, leaving data vulnerable to interception. Meanwhile, over 60% lacked essential security protections, increasing users’ exposure to cyberattacks, data theft, and other online threats.
Senior author Roya Ensafi, Associate Professor of Computer Science and Engineering at the University of Michigan, said millions of people trust VPN services to protect their digital privacy, but many applications are failing to meet even basic security expectations.
According to the researchers, the study is intended to provide consumers, regulators, and cybersecurity professionals with a clearer picture of how secure VPN apps actually are. The team hopes the findings will encourage users to make more informed choices while pressuring VPN providers to strengthen their security standards and improve transparency.
The study is reminder that installing VPN does not automatically guarantee online privacy. Experts say users should carefully evaluate VPN providers, their security practices, and independent audit records before trusting them with sensitive internet traffic.
