 The vulnerability allows an ISP, as well as any on-path eavesdroppers, to see what websites a user may be visiting.This is possible because the browser's DNS requests are sent to the ISP DNS server directly, and not sent through the VPN.This only occurs with certain types of VPNs, e.g.