Mullvad’s 2026 Android assessment: what passed, what changed

Record checked: October 25, 2026.

Mullvad’s Android app passed its second Mobile Application Security Assessment (MASA), conducted by Leviathan Security Group, after remediation. The initial app version was 2026.2; Mullvad says fixes were retested in 2026.3-beta3, subsequently released as 2026.3. The provider announced the result on June 1, 2026.

The public record supports a scoped app-security compliance result—not a no-logs verdict or a guarantee that Android traffic cannot escape a VPN tunnel.

What was assessed and certified

Leviathan’s initial developer test report identifies Android version 2026.2, Mobile App Specification v1.0 and assurance level AL2. Its summary is “REMEDIATION REQUIRED.” The final developer report identifies version 2026.3 and concludes “IN COMPLIANCE.”

The documents use different specification labels: the developer reports name Mobile App Specification v1.0, while the separate ADA compliance report records MASA specification version 2.0. The compliance report explains that AL2 means the authorized lab evaluates test cases directly against the application, rather than merely reviewing developer-supplied evidence. The detailed developer report includes static analysis, manual review and dynamic testing across storage, cryptography, authentication, networking, platform interactions, code, resilience and privacy requirements.

As of the record date, certificate 10238 shows:

• Product: Mullvad VPN Android app 2026.3, package net.mullvad.mullvadvpn.
• Testing laboratory: Leviathan Security Group, Inc.
• Certification body: TrustCB B.V.
• Status: Valid; issued June 3, 2026, valid until June 3, 2027.

The certificate expressly applies only to the specific version, release and evaluated configuration. It is not an endorsement or warranty. It also notes that TrustCB was provisionally authorized by ADA, but not yet accredited to ISO/IEC 17065 for this scheme at issuance.

Four accepted findings led to changes

Mullvad’s disclosure and technical summary describe six initial items, with four accepted for remediation. The practical changes were:

Finding	Change recorded
Pending intents were mutable without sufficient justification	Affected intents were changed to immutable. Mullvad judged the original risk limited because the app exposes little intent functionality.
Sensitive input was visible by default	The login account number and custom API access-method password were masked by default, reducing shoulder-surfing exposure.
Google Play data disclosures omitted purchase history	Mullvad says it updated the listing on February 24, 2026. It disclosed a purchase-to-account link retained for 20 days to support refunds.
No in-app account-deletion mechanism	Account deletion was added. The final lab report says deletion also removes the link between the account and associated payments.

The final developer report gives these requirements passing results. These are a mix of security controls, disclosure correction and user control—not four demonstrated compromises.

Removing a purchase-to-account link should not be read as deleting every payment record. Mullvad’s privacy policy separately states that certain payment data must be retained to meet legal requirements.

Mullvad says Leviathan verified the fixes on March 19, 2026, against 2026.3-beta3. The stable 2026.3 release, published March 23, lists account deletion and login-input masking among its changes.

Two other items need distinct treatment

Mullvad calls the dependency finding a false positive. However, the final lab report describes the initially flagged play-services-location dependency as updated and play-services-places-placereport as no longer included. The provider summary and lab report therefore do not fully reconcile whether this item was solely a detection error or also involved dependency changes. The final result is a pass; the precise disposition remains unclear.

For the compiler-hardening item, Mullvad says Leviathan retracted the finding. The final report records a pass after developer clarification that stack-canary protection was not a stable Rust feature at the time of assessment. That disposition should not be described as a newly implemented hardening fix.

What readers should—and should not—infer

This was a provider-arranged external assessment, with detailed lab reports published through Mullvad’s repository and a separately hosted certificate. Its value is the visible chain from initial findings to remediation and a version-specific compliance result.

It does not establish service-wide no-logging practices, certify every later Android build or prove protection against every operating-system-level VPN bypass. ADA itself warns that MASA’s limited testing does not guarantee complete application safety.

For users, 2026.3 marks the historical remediation release; the record is not a reason to install an old build instead of a current supported one. For privacy evaluation, keep this app assessment separate from evidence about server logging, retention and operational practices. The same scope discipline is explained in How to Read a VPN No-Logs Audit.