Mullvad VPN (Beta): baixar versions anteriors

This release is for desktop only.
Here is a list of all changes since last release 2026.5-beta1:
Changed
- Do not show dialog when rendering the map fails due to disabled GPU acceleration.

Windows
- Add timeout to device cleanup tasks during installs.
- Increase timeout on flushing DNS cache.

Removed

Windows
- Stop removing leftover Wintun adapters during installation. Wintun dropped support for adapter
pools, so this has not been necessary since 2022.5-beta1.

Fixed

Windows
- Wait for the tunnel routes to become usable, and retry the connection to the tunnel config
service if the tunnel is not ready yet. This may help with connection failures that occur
immediately after the tunnel is set up, when using quantum-resistant tunnels or DAITA.

This release is for desktop only.
Here is a list of all changes since last release 2025.13.

Removed
- Remove OpenVPN support from the app.
- See blog post for more info: https://mullvad.net/en/blog/removing-openvpn-15th-january-2026
- Remove "Automatic" as a setting for the "Quantum-resistant tunnel" option.

Changed
- Move settings in `WireGuard settings` view into the `VPN settings` view.
- Rename `Enable IpV6` setting to `In-tunnel` IPv6.
- Rename `IP version` setting to `Device IP` version.
- Merge `Obfuscation` settings and `WireGuard port` setting into new `Anti-censorship` view.
- Change `mullvad reconnect` to print an error message and exit with a non-zero exit code if issued in the disconnected state.

This release is identical to 2025.13-beta2.

This release is for desktop only.
Here is a list of all changes since last release 2025.13-beta1.

Fixed
- Fix bug introduced in 2025.13-beta1 with translations sometimes not being formatted correctly.

This release is for desktop only.
Here is a list of all changes since last release 2025.12.

Added
- Add settings reset command to the CLI (`mullvad reset-settings`).
- Make feature indicators in connection panel navigate to the relevant setting when clicked.
- Add Lightweight WireGuard Obfuscation method (LWO).
This is a cheap obfuscation method that prevents packets from being identified as standard WireGuard packets.
- Add possibility to manage devices from account view.

Changed
- Add validation for API access methods to only allow unique names.
Access methods with duplicated names will be renamed.
- Change how externally triggered navigation is handled in the UI.
This could potentially reduce issues where users get stuck in the out-of-time view.
- Update Electron from 36.5.0 to 37.6.0.
- Run version check hourly and when interacting with the app instead of once per day.
- Add support for gradual rollouts of new app releases.

Fixed
macOS
- Fix high CPU usage on macOS 26 by updating Electron.
This affected the app when it was visible.
Linux
- Install AppArmor profile on all Linux distributions that support AppArmor abi 4.0.

This release is identical to 2025.12-beta1.

This release is for desktop only.
Here is a list of all changes since last release 2025.11.

Fixed
Windows
- Mitigate BSOD caused by split tunnel driver during boot.

This release is for Windows only. This release reverts all functionality
to how the app worked in version 2025.9 to fix a BSOD (boot loop) bug.
Only a few users experienced the issue, but we deemed it critical enough to
revert everything until we have a better understanding of the problem.

This release is identical to 2025.10-beta2.

This release is for desktop only.
Here is a list of all changes since last release 2025.10-beta1.

Fixed
- QUIC obfuscation only using one in-address when connecting.
It will now randomly select one of the available in-addresses
for each connection attempt.
- `quinn_udp` crate flooding `mullvad-daemon.log` with warnings.

This release is for desktop only.
Here is a list of all changes since last release 2025.9.

Added
- Add helpful warnings when clearing account history.
This helps users not lose their account numbers.
Windows
- Add additional logging for tunnel devices and split tunneling to problem reports.
- Log WFP sessions when transaction lock timeout occurs.

Changed
- Move placement of login button from inside the account number input to under account number.
Windows
- Implement UDP GSO for QUIC on client socket.
This improves download speeds slightly.

Security
Windows
- Block traffic to exit node from non-Mullvad processes.
This fixes a leak where traffic could be encrypted once,
but leave the entry node unencrypted,
if and only if the destination were the exit node.
E.g., this might occur if a browser tries to open a TCP connection to the exit node IP.

Fixed
- Fix version being labeled unsupported unexpectedly.
So far, this only an issue when using development builds.
macOS
- Fix apps attempting to use IPv6 with in-tunnel IPv6 disabled.
- Re-add missing loopback alias if removed.
This fixes some issues with DNS resolution.

This release is identical to 2025.9-beta1.

This release is for desktop only.
Here is a list of all changes since last release 2025.8.

Added
- Add QUIC obfuscation (WireGuard only).
It will be used automatically when connecting fails with other methods.

Fixed
macOS
- Add support for parsing eslogger output version 10.
This fixes split tunneling on macOS 26.
- Avoid interpreting negative numbers from eslogger as PIDs.

This release is for desktop only.
Here is a list of all changes since last stable release 2025.7.

Added
- Add in-app updates to Windows and macOS.
This new feature lets you download, verify,
and install new versions from within the app.
Linux
- Make it possible to run the app with cgroups v1 fully disabled.
Note that split tunneling is currently unavailable when this is the case.
Windows
- Add a button to start the Mullvad VPN system service
if it's unavailable at launch

Changed
macOS
- Use a local DNS resolver on the 127.0.0.0/8 network,
regardless of macOS version.
Windows
- Make firewall rules applied while upgrading the app not persist on reboot,
unless "Lockdown mode" or "Auto-connect"
along with "Launch app on start-up" is enabled.
This serves as a safety fallback if the update fails
and the user is left with blocking firewall rules and no app.

Fixed
macOS
- Add grace period when best default route goes away
to reduce frequency of random reconnects.

Security
- Prevent unprivileged users from impersonating the gRPC server.
This was relatively harmless previously but is required due to in-app updates.
Windows
- Enable control flow integrity checks (CFG) for some C++ code.
This excludes `wintun`, `wireguard-nt`, and OpenVPN.
This addresses `MLLVD-CR-24-101` to the extent that we found it valuable.

This release is for desktop only.
Here is a list of all changes since last release 2025.8-beta2.

Fixed
Windows
- Fix issue with installer running in compatibility mode during update.

This release is for desktop only.
No changes since 2025.8-beta1.
This update is done in preparation for upcoming features.

This release is for desktop only.
Here is a list of all changes since last release 2025.7.

Added
- Add in-app updates to Windows and macOS.
This new feature lets you download, verify,
and install new versions from within the app.
Linux
- Make it possible to run the app with cgroups v1 fully disabled.
Note that split tunneling is currently unavailable when this is the case.
Windows
- Add a button to start the Mullvad VPN system service
if it's unavailable at launch

Changed
macOS
- Use a local DNS resolver on the 127.0.0.0/8 network,
regardless of macOS version.
Windows
- Make firewall rules applied while upgrading the app not persist on reboot,
unless "Lockdown mode" or "Auto-connect"
along with "Launch app on start-up" is enabled.
This serves as a safety fallback if the update fails
and the user is left with blocking firewall rules and no app.

Fixed
macOS
- Add grace period when best default route goes away
to reduce frequency of random reconnects.

Security
- Prevent unprivileged users from impersonating the gRPC server.
This was relatively harmless previously but is required due to in-app updates.
Windows
- Enable control flow integrity checks (CFG) for some C++ code.
This excludes `wintun`, `wireguard-nt`, and OpenVPN.
This addresses `MLLVD-CR-24-101` to the extent that we found it valuable.

This release is identical to 2025.7-beta1.

This release is for desktop only.
Here is a list of all changes since last release 2025.6.

Added
- Add notification that shows when the user is connected to WireGuard
with a port that is not supported.
Linux
- The deb package repositores now have static codenames on top of
the existing distro version specific codenames.
The stable repository always have the "stable" codename,
and the beta repository has the "beta" codename.

Changed
- Replace Classic McEliece with HQC as one of the post-quantum safe
key exchange mechanisms used for the quantum-resistant tunnels.
The main benefits here are that HQC uses a lot less CPU to compute the keypair,
and the public key sent to the server is drastically smaller.

Fixed
- Automatically connect when IP version becomes available.
Linux
- Fix syntax error in Apparmor profile.
- Fix issue where settings were lost after an upgrade if `mullvad-daemon`
was not restarted before `mullvad-early-boot-blocking.service``.
That is, before a reboot.
Windows
- Fix issue where daemon got stuck trying to connect only over IPv4 (or only IPv6).
macOS
- Fully uninstall the app when it is removed by being dropped in the bin.

Security
macOS
- Fix potential local privilege escalation when app was incorrectly removed
by being dropped in the bin but still leaving behind a launch daemon.
This fixes CVE-2025-46351 reported by Egor Filatov (Positive Technologies).

This release is for desktop only.
Here is a list of all changes since last release 2025.6-beta1.

Fixed
- Fix "No OpenVPN servers" warning being displayed erroneously.

This release is for desktop only.
Here is a list of all changes since last release 2025.5.

Added
- Add a notification for notifying users about the sunsetting of OpenVPN.

Changed
Windows
- Rename `win-shortcuts` native module to `windows-utils`.

Removed
- Remove "Automatic" option for tunnel protocol. The default is now WireGuard.

Fixed
- Fix `mullvad-cli`` panicking if it tried to write to a closed pipe on Linux and macOS.
- Fix bug where new users are not forwarded to the main view after payment.
- Will no longer try to connect over IPv4 if IPv4 is not available.
Windows
- Fix error setting up tunnel when MTU was incorrectly set to a value below 1280 for IPv6.
- Fix node native module being unpacked to a temporary folder.
- Fix BSOD caused by routing loop in wireguard-nt.
macOS
- Fix bug in parsing of network services from SCDynamicStore.

This release is for desktop only.
This release is identical to 2025.5-beta1.
Here is a list of all changes since last stable release 2025.4.

Added
Windows
- Add support for DAITA V2.
- Add back wireguard-go (userspace WireGuard) support.

Fixed
macOS
- Fix daemon ending up in blocked state if the user toggled split tunneling without having granted
Full Disk Access to `mullvad-daemon`. This could only ever be accomplished from the CLI.
- Fix routing issue caused by upgrading `tun`.

Removed
- Stop bundling https://github.com/mullvad/apisocks5 as a standalone binary.
- Remove Google's resolvers from encrypted DNS proxy.

This release is for desktop only.
Here is a list of all changes since last release 2025.4.

Added
Windows
- Add support for DAITA V2.
- Add back wireguard-go (userspace WireGuard) support.

Fixed
macOS
- Fix daemon ending up in blocked state if the user toggled split tunneling without having granted
Full Disk Access to `mullvad-daemon`. This could only ever be accomplished from the CLI.
- Fix routing issue caused by upgrading `tun`.

Removed
- Stop bundling https://github.com/mullvad/apisocks5 as a standalone binary.
- Remove Google's resolvers from encrypted DNS proxy.

This release is for desktop only.
This release is identical to 2025.4-beta1.
Here is a list of all changes since last stable release 2025.3.

Changed
Windows
- Fix GUI crashing at launch on some systems.

This release is for desktop only.
Here is a list of all changes since last stable release 2025.3.

Changed
Windows
- Fix GUI crashing at launch on some systems.

This is a desktop only release.
Here is a list of all changes since last stable release 2025.2.

Added
Windows
- Add support for Windows ARM64.

Changed
- (Linux and macOS only) Update to DAITA v2.
The main difference is that many different machines are
provided by relays instead of a bundled list.
The bundled `maybenot_machines` file was removed.
- Move changelog from a dialog to a separate view.
- Reduce the setup time of PQ tunnels by pre-computing McEliece keys.
- Change order of items in settings view to show DAITA and multihop at the top.
- Update Electron from 30.0.4 to 33.4.0.

Fixed
- (macOS and Windows only) Add the correct route when using obfuscation with Wireguard.

This release is for desktop only.
Here is a list of all changes since last stable release 2025.2.

Added
Windows
- Add support for Windows ARM64.

Changed
- (Linux and macOS only) Update to DAITA v2.
The main difference is that many different machines are
provided by relays instead of a bundled list.
The bundled `maybenot_machines` file was removed.
- Update Electron from 30.0.4 to 33.2.1.
- Move changelog from a dialog to a separate view.
- Reduce the setup time of PQ tunnels by pre-computing McEliece keys.
Fixed
- (macOS and Windows only) Add the correct route when using obfuscation with Wireguard.

This release is for desktop only.
Here is a list of all changes since last stable release 2025.1.

Fixed
- Fix crash when Wireguard tunnel setup timed out.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.8.

Added
- Add a new access method: Encrypted DNS Proxy.
Encrypted DNS proxy is a way to reach the API via proxies.
The access method is enabled by default.
macOS
- Detect whether full disk access is enabled in the split tunneling view.
- Add button to restart system service in split tunneling view.
This can help mitigate edge-case issues when enabling full disk access.

Changed
- Replace the draft key encapsulation mechanism Kyber (round 3) with the standardized
ML-KEM (FIPS 203) dito in the handshake for Quantum-resistant tunnels.
- Make Smart Routing override multihop if both are enabled.
To manually set the entry relay, explicitly enable the "Direct only" option in the DAITA settings.
- Update maybenot from 1.1.3 to 2.0.1.

Windows
- Enable quantum-resistant tunnels by default (when set to `auto`).

Fixed
- Handle network switching better when using WG over Shadowsocks.
- Fix multihop entry location list sometimes being shown when multihop is disabled.
macOS
- Fix GUI getting stuck when opening the split tunneling view.
- Fix packets being duplicated on LAN when split tunneling is enabled.
- Fix DNS issues caused by forcibly using a local DNS resolver in all states.
Note that this fix is not present on macOS versions between 14.6 and 15.1.

Security
Windows
- Block WSL/Hyper-V traffic in secured states (except the connected state).
The normal firewall (WFP) filters normally do not apply for VMs.
This mitigates the issue by ensuring that it does not leak (as easily) when the VPN tunnel is up.
Previously, WSL would leak while in the blocked or connecting state, or while lockdown mode was active.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.8.

Added
- Add a new access method: Encrypted DNS Proxy.
Encrypted DNS proxy is a way to reach the API via proxies.
The access method is enabled by default.
macOS
- Detect whether full disk access is enabled in the split tunneling view.
- Add button to restart system service in split tunneling view.
This can help mitigate edge-case issues when enabling full disk access.

Changed
- Replace the draft key encapsulation mechanism Kyber (round 3) with the standardized
ML-KEM (FIPS 203) dito in the handshake for Quantum-resistant tunnels.
- Make Smart Routing override multihop if both are enabled.
To manually set the entry relay, explicitly enable the "Direct only" option in the DAITA settings.
- Update maybenot from 1.1.3 to 2.0.1.

Windows
- Enable quantum-resistant tunnels by default (when set to `auto`).

Fixed
- Handle network switching better when using WG over Shadowsocks.
- Fix multihop entry location list sometimes being shown when multihop is disabled.
macOS
- Fix packets being duplicated on LAN when split tunneling is enabled.
- Fix DNS issues caused by forcibly using a local DNS resolver in all states.
Note that this fix is not present on macOS versions between 14.6 and 15.1.

Security
Windows
- Block WSL/Hyper-V traffic in secured states (except the connected state).
The normal firewall (WFP) filters normally do not apply for VMs.
This mitigates the issue by ensuring that it does not leak (as easily) when the VPN tunnel is up.
Previously, WSL would leak while in the blocked or connecting state, or while lockdown mode was active.

This release is for desktop only.
This release addresses issues identified in a recent audit.
Here is a list of all changes since last stable release 2024.7.

Security
- Remove invalidly set up alternative stack for fault signal handlers on unix based systems.
This prevents potential stack overflow and heap memory corruption.
Fixes audit issue `MLLVD-CR-24-01`.
- Remove/disable not signal safe code from fault signal handler on unix based systems.
Fixes audit issue `MLLVD-CR-24-02`.
Windows
- Fix issue where the installer would allow any executable named `taskkill.exe`` in the working directory to run as admin.
Fixes audit issue `MLLVD-CR-24-06`.
Linux
- Prevent attackers able to send ARP requests to the device running Mullvad from figuring out the in-tunnel IP.
Fixes audit issue `MLLVD-CR-24-03`.

This release is for desktop only.
This release is identical to 2024.7-beta1.
Here is a list of all changes since last stable release 2024.6.

Fixed
macOS
- Fix DNS not working due to broken PF redirect.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.6.

Fixed
macOS
- Fix DNS not working due to broken PF redirect.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.5.

Added
- Add WireGuard over Shadowsocks obfuscation. It can be enabled in "WireGuard settings".
This will also be used automatically when connecting fails with other methods.
- Add feature indicators to the main view along with redesigning the connection details.
- Add "Smart Routing" feature which simplifies connecting to DAITA-enabled relays.

Changed
- Never use OpenVPN as a fallback protocol when any of the following features is enabled:
multihop, quantum-resistant tunnels, or DAITA.
- Improved output format of mullvad status command, which now also prints feature indicators.
- Move DAITA and multihop to the root settings view along with moving multihop into a dedicated view with more information.
macOS
- Disable split tunnel interface when disconnected.
This prevents traffic from being sent through the daemon when the VPN is disconnected.
- Enable IPv6 by default. This fixes DNS and routing being broken on some systems.
- Proxy DNS queries through a local resolver.

Fixed
Linux
- Set tunnel name to `wg0-mullvad` for userspace WireGuard.
macOS
- Exclude programs when executed using a relative path from a shell.
- Reduce packet loss when using split tunneling.
- Don't block fragmented packets in the PF firewall.
Fixes various issues relating to connecting (and general instability) when IP fragmentation is present.
- Fix Apple services not working by forcing stray connections out through the VPN tunnel.
This fix only applies to Wireguard, OpenVPN is still affected.
- Disable DNS redirect when custom DNS is set to localhost.

This release is for desktop only.
Here is a list of all changes since last beta release 2024.6-beta1.

Changed
- Move DAITA and multihop to the root settings view along with moving multihop into a dedicated view with more information.
macOS
- Enable IPv6 by default. This fixes DNS and routing being broken on some systems.
- Proxy DNS queries through a local resolver.

Fixed
macOS
- Fix Apple services not working by forcing stray connections out through the VPN tunnel.
This fix only applies to Wireguard, OpenVPN is still affected. The "bypass" toggle has been removed.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.5.

Added
- Add WireGuard over Shadowsocks obfuscation. It can be enabled in "WireGuard settings".
This will also be used automatically when connecting fails with other methods.
- Add feature indicators to the main view along with redesigning the connection details.
- Add "Smart Routing" feature which simplifies connecting to DAITA-enabled relays.
macOS
- Add "Apple services bypass" toggle that let's users unblock certain Apple-owned networks.
This is a temporary fix to the MacOS 15 issues where some Apple services are being blocked.

Changed
- Never use OpenVPN as a fallback protocol when any of the following features is enabled: multihop, quantum-resistant tunnels, or DAITA.
- Improved output format of mullvad status command, which now also prints feature indicators.
macOS
- Disable split tunnel interface when disconnected.
This prevents traffic from being sent through the daemon when the VPN is disconnected.

Fixed
Linux
- Set tunnel name to `wg0-mullvad` for userspace WireGuard.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.4.

Added
- Add DAITA (Defence against AI-guided Traffic Analysis) setting for Linux and macOS.
- Add --json flag to mullvad status CLI.

Changed
- Ignore obfuscation protocol constraints when the obfuscation mode is set to auto.
macOS
- Enable quantum resistant tunnels by default (when set to auto).

Fixed
- Fix mullvad cli bug causing mullvad status listen command to miss events if they occurred too quickly.
- Fix bug causing app to enter blocked state when toggling DAITA on and off.
- macOS and Linux: Fix potential crash when disconnecting with DAITA enabled.
macOS
- Fix intermittent failures to connect with PQ enabled.

This release is for desktop only.
Here is a list of all changes since last stable release 2024.4.

Added
- Add DAITA (Defence against AI-guided Traffic Analysis) setting for Linux and macOS.
- Add --json flag to mullvad status CLI.

Changed
- Ignore obfuscation protocol constraints when the obfuscation mode is set to auto.
macOS
- Enable quantum resistant tunnels by default (when set to auto).

Fixed
- Fix mullvad cli bug causing mullvad status listen command to miss events if they occurred too quickly.
- Fix bug causing app to enter blocked state when toggling DAITA on and off.
macOS
- Fix intermittent failures to connect with PQ enabled.