Android - How to VPN only a single application?

The free and open-source OpenVPN for Android app supports this.

In the profile configuration dialog, there is an 'allowed apps' tab that allows you to select a list of apps that is either excluded or excluded from using the established VPN:

• 'VPN is used for all apps but exclude selected'
• 'VPN is used for only for selected apps' (sic)

The list then contains all available apps that can be selected/deselected.

This doesn't require a rooted device. For example, it works fine on a Nexus 5x device with stock Android 8.1.

A simple test is to install another broswer like Firefox, include just one of Chrome and Firefox in the list and then switch around browsers and visit https://wtfismyip.com in both.

One pitfall is when you are on a dual-stack IPv4+IPv6 network but the VPN is IPv4 only. In that case, the 'Bypass VPN for local networks' in the 'Routing' tab needs to be disabled. Otherwise, IPv6 traffic travels unencrypted besides the VPN.