Windscribe/Desktop-App v2.24.3

v2.24.3-alpha

on GitHub

Improved

• Custom SNI handling by keeping Custom SNI Domain visible/editable independently of the Protocol Tweaks mode, while still applying it only to Stealth/stunnel and WSTunnel connections.
• wsnet/desktop hardening by validating values received from wsnet and applying wsnet security-audit fixes for URL construction, TLS/network handling, logging, parsing, and failover robustness.
• DNS leak firewall setup by de-duplicating DNS server entries before adding Windows firewall filters on Windows.
• Split tunneling so non-tunneled apps can preserve native ISP IPv6 on dual-stack networks while tunneled apps remain leak-protected on Linux.
• Networking-service handling so installers avoid force-enabling NetworkManager/systemd-resolved and nmcli-dependent features degrade gracefully when unavailable on Linux.

Fixed

• Local root escalation chain involving SGID helper descriptor reuse and OpenVPN custom config parser differences on Linux.
• Inclusive split tunneling with WireGuard on Windows tunneling non-included traffic through the VPN.
• Inclusive split tunneling on Windows blocking native ISP IPv6 for non-included apps on dual-stack networks.
• HTTP Proxy settings rejecting valid high port numbers in the 63536-65535 range.
• Always On+ firewall mode skipping WireGuard when a valid cached WireGuard config is available.
• Always On+ unsecured-network handling disconnecting during WireGuard-to-OpenVPN fallback when no cached WireGuard config is available.
• Insecure OpenVPN management interface behavior that could allow local management-port hijacking, spoofed VPN state, or credential capture.
• Split tunneling extension lifecycle bugs and improved cleanup on macOS.
• openSUSE Tumbleweed SSL/API validation failures caused by missing Debian-style CA bundle path.

Updated

• wsnet to 1.5.29, including security-audit hardening and a fix for Linux CA bundle loading with cURL 8.21.

GUI Installer Hashes

CLI Installer Hashes

Linux Installer GnuPG Key