“These finding also shows once again that "Block connections without VPN" does not live up to its name (or documentation) and that it has multiple flaws.”
Android 14 leaks plaintext DNS queries when a VPN reconnects, crashes or has no DNS server set. It happens with Always-on VPN and “Block connections without VPN” both switched on. Chrome is one of the apps that triggers it. The leak shows where you are and what you visit. Google ships a kill switch that lets traffic out, and Mullvad’s advice for sensitive work is to avoid Android altogether.