The vulnerability enables clustering outgoing Mullvad traffic into user-sized buckets based on metadata analysis alone.
Clustering, in turn, allows time-based deanonymization[1], against the users assumptions of being sufficiently anonymized.
Adversaries who do not enjoy a backbone-traffic MitM vantage point cannot exploit this vulnerability, which makes it appear NOBUS-y.
1. Any *aaS, forum, or board, when given a (Mullvad!) IP address and series of request timestamps, and a subpoena, can yield PII on the real identity (email, phone, billing address)
