Mullvad vulnerabilities
We track 3 vulnerabilities in Mullvad products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 19, 2026.
Latest Mullvad vulnerabilities
- 7.8 High severity
mullvadvpn-app: Improper Privilege Management
Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app
- 7.5 High severity
mullvad_vpn: Improper Restriction of Communication Channel to Intended Endpoints
Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be ob
- 7.8 High severity
Mullvad VPN: Incorrect Permission Assignment for Critical Resource
An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM.