In contrast, GrapheneOS, a security-focused Android-based OS, quickly patched the issue in its codebase.

Good that I use GrapheneOS.

LOL if that's the fix and the Android Security team won't fix it... jfc what a joke

I have a bunch of android based barcode scanners at work that we have to use adb to do some of the configuration setup. it's a powerful tool but it's not rocket science or anything more complicated than command line stuff

This disables the QUIC graceful shutdown feature, and thus closes the leak. The mitigation will persist across reboots, but it may be undone by system updates, in which case the steps will need to be repeated.

Performing this mitigation means that the server-side QUIC socket will remain half-open until it times out, which should generally not negatively affect the Android device or apps running on it. However, only use the command at your own risk if you understand the implications.

does anyone know what are the implications of the fix proposed?

However, at the time of writing the issue is marked as inaccessible by Google for unknown reasons.

"Don't be evil"

Isn't QUIC long gone, merged into HTTP/3?

Yeah, haha sure, a bug... 🙄

nice, gonna use the fix as soon as I get home.

EDIT:

This disables the QUIC graceful shutdown feature, and thus closes the leak. The mitigation will persist across reboots, but it may be undone by system updates, in which case the steps will need to be repeated.

Performing this mitigation means that the server-side QUIC socket will remain half-open until it times out, which should generally not negatively affect the Android device or apps running on it. However, only use the command at your own risk if you understand the implications.

anyone knows the implications of this?

Android 16 introduced a bug

Security via poverty, like I can even run andriod 16 😎