Android 16 has a bug that lets apps route traffic outside your VPN tunnel and expose your real IP address, even with strict VPN settings enabled.