A recently discovered bug in Android 16 allows any app to leak traffic outside the VPN tunnel.