mullvad/mullvadvpn-app 2025.8

on GitHub

This release is for desktop only.

Here is a list of all changes since last stable release 2025.7:

Added

• Add in-app updates to Windows and macOS. This new feature lets you download, verify, and install
  new versions from within the app.

Linux

• Make it possible to run the app with cgroups v1 fully disabled. Note that split tunneling is
  currently unavailable when this is the case.

Windows

• Add a button to start the Mullvad VPN system service if it's unavailable at launch

Changed

macOS

• Use a local DNS resolver on the 127.0.0.0/8 network, regardless of macOS version.

Windows

• Make firewall rules applied while upgrading the app not persist on reboot, unless "Lockdown mode"
  or "Auto-connect along with "Launch app on start-up" is enabled. This serves as a safety fallback
  if the update fails and the user is left with blocking firewall rules and no app.

Fixed

macOS

• Add grace period when best default route goes away to reduce frequency of random reconnects.

Security

• Prevent unprivileged users from impersonating the gRPC server. This was relatively harmless
  previously but is required due to in-app updates.

Windows

• Enable control flow integrity checks (CFG) for some C++ code. This excludes wintun,
  wireguard-nt, and OpenVPN. This addresses MLLVD-CR-24-101 to the extent that we found
  it valuable.