ExpressVPN 14.3.1 separates Advanced Protection from the Lightway protocol
The main change in 14.3.1 is where Advanced Protection works. According to TechRadar, which first reported the cross-platform release, Advanced Protection on the desktop apps used to work only while the VPN was connected with the Lightway or Automatic protocol selected. Version 14.3.1 lifts that restriction, so you can now block ads, trackers, and harmful sites while using OpenVPN or WireGuard.
ExpressVPN's own Linux release notes, dated September 22, 2026, confirm the change in general terms. They say Advanced Protection now works across all VPN protocols, not just Lightway, and that the feature is rolling out gradually and may not be available to everyone yet. The notes don't list the newly supported protocols or give a date when every account will have the feature.
Until now, users had to choose between protocol and protection. People usually switch from Lightway to OpenVPN or WireGuard because a hotel network, corporate firewall or ISP handles one protocol better than another. Under earlier builds, that switch turned off the blocking layer too. TechRadar notes that the change helps anyone who switches protocols to cope with tricky networks, since you no longer have to give up those protections to do it.
Advanced Protection filters at the DNS and network level. ExpressVPN introduced it on Linux in early 2024 as a bundle of an ad blocker, an adult-site blocker and Threat Manager, which blocks malicious sites and trackers. The company says the ad blocker filters "most display ads," which is a narrower promise than blocking all of them. It adds a layer on top of Microsoft Defender or another endpoint security product and doesn't replace one.
Because the rollout is staged, the option may still be locked to Lightway right after you update. That doesn't mean the update failed. ExpressVPN simply hasn't turned it on for that account or device yet.
Split tunneling in 14.3.1 gets fixes aimed at Windows CPU use and Mac DNS
Split tunneling lets you choose which apps use the VPN tunnel and which go straight to your normal connection. It is one of the settings people rely on most, and in the past it has also caused bugs. ExpressVPN's Linux notes for 14.3.1 say routing is more reliable for apps you exclude from the VPN, protocol information is clearer in the split view, and the setup guidance has been refreshed. TechRadar describes the same improvements for the desktop release as a whole.
The Windows change is specific. On Windows, the feature no longer keeps scanning for new apps when it's switched off, which cuts CPU usage. Before 14.3.1, the app kept watching for newly installed apps even with split tunneling turned off, so it used CPU for a feature nobody had enabled. Neither TechRadar nor ExpressVPN has given a figure for how much CPU the old behaviour used. It is most likely to matter on laptops, where background work drains the battery.
The Mac change affects how split tunneling and Advanced Protection work together. On Mac, split tunneling now leaves DNS traffic alone, so it can run alongside Advanced Protection. Advanced Protection's blocking depends on DNS, so any split-tunneling component that intercepted DNS on the Mac would have conflicted with it. The Mac client is fairly new. Tom's Guide reported that Mac gained split tunneling and a full command-line interface via the Qt framework rollout in December 2025.
Windows users may remember an earlier split-tunneling problem. In February 2024, it was revealed that ExpressVPN software had contained a bug for nearly two years that exposed the domains users were visiting. The bug was present in Windows versions published between May 19, 2022, and February 7, 2024, affecting those who were using the split tunneling feature. Nothing in 14.3.1 relates to that bug. It explains, though, why split tunneling on Windows gets close attention whenever it changes.
Windows 14.3.1 fixes Modern Standby drops and ARM64 installs
Two fixes apply only to Windows, and both come from TechRadar's report. With the fix, the VPN stays connected when the screen turns off on PCs that use Modern Standby. Installation is also more reliable on ARM64 devices.
Modern Standby is the Windows power model used on many recent laptops and on Windows on ARM machines. The system stays partly active and connected when the screen goes dark instead of fully suspending. A VPN client that treats the screen turning off as a disconnect can drop the tunnel even while Windows keeps the network up. The user comes back to an unprotected connection, or to a reconnect delay if a kill switch blocked traffic in the meantime. The report says the connection now holds when the screen turns off. It doesn't claim every sleep-related disconnect is fixed, so a PC that drops the VPN during full hibernation or after a network change isn't necessarily covered.
This continues earlier work on sleep behaviour. Tom's Guide reported that version 14.1.0, released in the spring, improved reconnection so that the app now re-establishing a VPN connection more reliably when a device wakes from sleep. That fix handled what happens after sleep. The 14.3.1 fix aims to keep the connection from dropping in the first place on Modern Standby hardware.
The ARM64 install fix affects the growing number of Snapdragon-based Windows 11 laptops. TechRadar hasn't described which installation failures users hit before, so the only confirmed detail is improved reliability in general.
The Windows build is real and has a specific number. The community Windows Package Manager manifest repository received an automated pull request titled New version: ExpressVPN.ExpressVPN version 14.3.1+15429. Warp2Search also listed the Windows release as version 14.3.1.15429. As of this writing, ExpressVPN's public Windows release-notes page doesn't show a 14.3.1 entry. The Windows-specific fixes above therefore rest on TechRadar's reporting, while the build itself is confirmed by the package listings.
Linux 14.3.1 has the most detailed official changelog
Of the three platforms, only Linux has a full official changelog for this release, and it is the longest. On Linux, ExpressVPN says it improved Lightway routing and DNS configuration on systems that use resolvectl, including fixes for Pop!_OS and other distributions running systemd 255. resolvectl is the command-line front end to systemd-resolved, the DNS resolver many modern distributions use. VPN clients that configure DNS through it have to handle changes in behaviour between systemd releases. The fix is limited to that configuration, and ExpressVPN doesn't claim it covers every DNS setup.
The rest of the Linux list is mostly interface and reliability work:
- Connection notifications now use the desktop environment's native notification system, which fixes notifications that didn't appear on some desktops.
- The tray icon animates while connecting, and the app shows "Reconnecting" while it restores a dropped connection.
- Recently used locations are easier to find and reuse, and duplicate entries have been removed from the list.
- Sign-in is faster and more reliable, scroll bars hide when idle, and the window stays on screen when switching between compact and full mode or moving between monitors.
- Selecting Norwegian now actually switches the app to Norwegian, and an installer error during network-permission setup has been fixed.
These items appear only in the Linux notes, so don't assume the Windows or Mac builds changed the same way. The Mac release has its own fixes, per TechRadar. The app no longer lets Docker containers disrupt networking while the VPN is connected, and it now launches when no network is available after waking or booting. The Docker fix matters to developers who run containers on a Mac with the VPN connected, since Docker's virtual networking and a VPN's routing can clash.
The Linux app was rebuilt from the ground up recently. ExpressVPN's notes show version 5.0.0 in November 2025, a redesign that added a built-in speed test, Dedicated IP support and post-quantum WireGuard next to Lightway and OpenVPN. Numbering then jumped to 14.0.0 in April 2026, which brought Linux in line with the other desktop apps.
The rebuilt speed test and screen-reader work in 14.3.1
The other two headline changes apply to all platforms but are harder to measure. The built-in speed test has been rebuilt to run faster and deliver more precise results, according to TechRadar, and ExpressVPN's Linux notes say the same. Neither source publishes a benchmark, a testing method or any number behind "faster" and "more precise." Take it as a vendor claim, and trust it only as far as the results you see on your own connection.
The accessibility work is more concrete. On the accessibility side, screen readers can now navigate the location list, protocol settings, split tunneling, and auto-connect rules. The Linux notes add that the app now announces connection status, settings changes and dialog content. Those are the areas where a blind or low-vision user most needs spoken feedback. Without it, a screen-reader user can't easily tell whether the VPN is actually connected or which server they picked. TechRadar ties the work to the accessibility push in version 14.1.0 and notes that its own review had rated the app's accessibility three out of five.
The detailed list of screen-reader improvements is confirmed only in the Linux changelog. TechRadar describes stronger screen-reader support across the desktop apps, which makes it likely, though not documented, that Windows users with Narrator or NVDA get the same navigation coverage.
What this means for you
If you already run ExpressVPN on Windows, update to 14.3.1. Check two things afterward: whether Advanced Protection now stays available when you pick OpenVPN or WireGuard, and whether your Modern Standby laptop keeps the tunnel up when the screen turns off. Users who never change from the default protocol and don't use split tunneling will notice less, apart from the lower background CPU use and the speed-test rebuild.
TechRadar says existing installs should update automatically and that new users can download the current build from ExpressVPN's website. The app version now appears at the bottom of the sidebar, which ExpressVPN's Linux notes confirm for that platform. Windows administrators who deploy through Windows Package Manager can use the package ID ExpressVPN.ExpressVPN. The 14.3.1+15429 build appeared in an automated manifest pull request, and it reaches winget upgrade once that manifest is merged into the repository.
- Confirm you're on 14.3.1 by checking the version at the bottom of the app's sidebar. On Windows, the confirmed build is 14.3.1+15429.
- Advanced Protection on OpenVPN and WireGuard is rolling out gradually. If it doesn't appear yet, the update didn't fail; ExpressVPN hasn't enabled it for you yet.
- Windows laptops with Modern Standby should now keep the VPN connected when the screen turns off. Keep the kill switch on anyway, because disconnects caused by hibernation or network changes aren't claimed as fixed.
- Leaving split tunneling off on Windows no longer costs CPU on background app scanning, which helps battery life on portable machines.
- If you use ARM64 Windows devices and a previous ExpressVPN install failed, retry it with the 14.3.1 installer.
- Treat Advanced Protection as an extra filtering layer alongside Microsoft Defender or your endpoint product. It doesn't replace either.
With 14.3.1, choosing a VPN protocol no longer means giving up the blocking layer, once the staged rollout reaches your account. On Windows, the release mostly fixes background CPU use, connections on Modern Standby laptops and ARM64 installs, and those are the parts most users will notice. The remaining step is ExpressVPN's gradual rollout of Advanced Protection on OpenVPN and WireGuard, which reaches accounts on no published schedule. When it arrives, you can switch protocols to deal with a difficult network without losing ad and tracker blocking.