Hundreds of Free VPN Apps Expose Android and iOS Users’ Personal Data

Hundreds of free VPN apps for Android and iOS have been found to expose users’ personal data, according to Zimperium zLabs, which analysed 800 such apps. The research uncovers widespread security flaws, including the continued use of outdated third‑party libraries and the presence of vulnerable code, with several apps still relying on legacy versions of the OpenSSL library and exposed to the Heartbleed bug (CVE-2014-0160).

It also notes that around 1% of the analysed VPNs were vulnerable to Man-in-the-Middle attacks due to improper certificate validation, meaning attackers could intercept traffic. The study highlights significant privacy policy non‑compliance on iOS, with 25% of examined apps failing to include valid privacy manifests and many others mislabeling data practices.

Enterprise risks accompany these findings, as BYOD deployments can turn compromised VPN apps into a weak link in security, enabling reconnaissance, credential theft, and lateral movement if exploited.