GrapheneOS

@nprofile…hpz0 We're not aware of any jurisdiction where it would be illegal to set a duress PIN/password. Enabling it doesn't at all imply giving it to law enforcement when asked for a PIN/password. It can be used without explicitly giving it to someone else and isn't in any way specific to law enforcement. For example, the duress PIN/password can be written down on paper kept in the phone case and/or wallet marking it as a PIN/password. GrapheneOS also doesn't depend on this to protect data at all.

2026-07-23 21:50:11 CEST

- reply

2026-07-23 09:53:13 CEST

- reply

@nprofile…2np5 @nprofile…yw9y No, as we said there will be an API to detect it similarly to Mock Location.

2026-07-22 22:57:08 CEST

GrapheneOS Info app version 7 released:
https://github.com/GrapheneOS/Info/releases/tag/7
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/40606-grapheneos-info-app-version-7-released
#GrapheneOS #privacy #security

2026-07-22 22:57:04 CEST

Vanadium version 151.0.7922.47.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.47.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/40605-vanadium-version-15107922470-released
#GrapheneOS #privacy #security #browser

2026-07-22 22:40:38 CEST

- reply

@nprofile…yw9y Hopefully under 6 months. It would probably take around a week to implement and depends on what we prioritize over the next several months.

2026-07-22 22:40:04 CEST

- reply

@nprofile…yw9y Hopefully under 6 months.

2026-07-22 22:10:40 CEST

- reply

@nprofile…yw9y Mock Location via developer options is a standard Android feature but we're developing per-app Location Scopes as a better alternative. It will be able to spoof a different location on a per-app basis. We can also make our own API for detecting it's active to avoid apps banning Mock Location banning using it while also avoiding apps banning GrapheneOS as a whole for it since they can use the API for detecting it's active. That will maximize compatibility.

2026-07-22 19:32:31 CEST

- reply

@nprofile…7a7m Device and strong integrity require a Google certified device running the unmodified stock OS. Basic is expected to pass when logged into a Google account which can be a purpose-specific throwaway but those won't.
GrapheneOS has a feature intercepting Play Integrity API requests and it uses that to show a notice when an app uses it so you would know if the app was using Play Integrity API. If there isn't a notification, it isn't.

2026-07-22 15:33:59 CEST

- reply

@nprofile…t9a9 New major releases of Android resolve major privacy weaknesses and greatly improve security with new features.
High/Critical severity patches are backported to older releases, but not new protections. Near zero Low/Moderate patches are backported. Android is moving to no longer backporting most High severity patches and many Critical severity patches due to AI accelerating vulnerability discovery.
Pixels driver and firmware updates also require the latest release, currently Android 17.

2026-07-22 15:29:41 CEST

- reply

@nprofile…t9a9 See https://eylenburg.github.io/android_comparison.htm for a third party comparison between operating systems based on the Android Open Source Project (AOSP). It doesn't cover the many connections added by operating systems and doesn't cover a lot of added privacy or security features but it gets across how different the overall approach is across these.
Keeping up with standard updates is very important. GrapheneOS moved to Android 17 on day 1. None of the others there has moved. That's required for many patches.

2026-07-22 15:21:51 CEST

- reply

@nprofile…t9a9 GrapheneOS greatly improves both privacy and security compared to the Android Open Source Project while CalyxOS does the opposite by lagging far behind standard patches and protections. They're not in the same space.
Nearly every Android app is compatible with GrapheneOS. It has our sandboxed Google Play compatibility layer to run apps depending Google Play. Banking apps are a special case but most work. App compatibility is much work on operating systems using microG including CalyxOS.

2026-07-21 21:34:36 CEST

- reply

@nprofile…wjlp You can clear the app data for Seedvault and do it over again. We know the user interface for it needs a lot of work. It needs a massive overhaul and at least a partial rewrite.

2026-07-21 02:09:01 CEST

- reply

@nprofile…72u4 @nprofile…2p5t It was eventually suspended there too a while after this discussion.

2026-07-21 01:36:39 CEST

- reply

@nprofile…2p5t mastodon.social has suspended it now.

2026-07-20 23:12:12 CEST

- reply

@nprofile…2p5t It was suspended by the infosec.exchange moderators, not mastodon.social. An instance can suspend an account from another instance to block any of the content being visible or any direct interactions with the account such as replies. It got reported by a bunch of people even before we replied so some instances have blocked it, but not the one it's actually hosted on. We would prefer if the person who made it renames the website and the accounts themselves so we reached out here.

2026-07-20 23:09:52 CEST

- reply

@nprofile…9mxm As an example, our Vanadium browser is a play on the name Chromium. Stainless steel is made by adding chromium and vanadium is often added to give it further strength. Vanadium is a very distinct name from Chromium so there's little room for confusion but it also shows the basis for the project. You could make your own name for this that's similarly distinct but it could be some variation of carbon, another nanomaterial or something like that if you want it to be tied to it.

2026-07-20 22:51:49 CEST

- reply

@nprofile…9mxm It needs to be made much clearer that this is an independent organization and not part of GrapheneOS. It should have a separate name that's distinct from GrapheneOS.
The website and social media accounts for it should use a distinct name after coming up with one. The website should be moved to a new domain with the distinct name and the previous domain can be temporarily redirected for several months.
As shown by the replies, many people think it's official or pretending to be.

2026-07-20 21:13:31 CEST

- reply

@nprofile…5yuq He's a GrapheneOS user who makes video content about it. He isn't part of the GrapheneOS project himself and we aren't partnered in an official way. Our community manager is doing a live stream with him.

2026-07-20 19:30:15 CEST

- reply

@nprofile…5yuq We arem't affiliated. He's someone with no official involvement with us doing an interview with our community manager.

2026-07-20 19:29:49 CEST

- reply

@nprofile…5yuq We arem't affiliated but rather he's doing an interview with our community manager.

2026-07-20 07:36:45 CEST

- reply

@nprofile…a6cc Seems you either left out the text or didn't meant to reply.

2026-07-20 07:36:33 CEST

- reply

@nprofile…a6cc Seems you either left out the text or didn't meant to reply.

2026-07-20 05:08:31 CEST

GmsCompatConfig version 172 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-172
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/40515-gmscompatconfig-version-172-released
#GrapheneOS #privacy #security #gmscompat

2026-07-20 01:25:39 CEST

- reply

@nprofile…lalv We're partnered with Motorola Mobility rather than Motorola solutions. They're entirely separate companies since the split in 2011. Motorola Mobility was acquired by Google in 2012 and then sold to Lenovo inn 2014.
Motorola Mobility is the successor of the consumer hardware division while Motorola Solutions makes much more niche products focused on government contracts.
Motorola Mobility wants to get into the enterprise and government markets so they're focusing on improving security.

2026-07-19 15:00:39 CEST

- reply

Additionally, we will also be watching for your questions and comments in the media channels within our Discord and Matrix chats:
https://grapheneos.org/contact#community-chat

2026-07-19 15:00:29 CEST

Join Josh from Side Of Burritos and our Community Manager spring-onion in a live conversation about everything GrapheneOS on July 20th!
PDT - 10:00 / 10:00 AM
EDT - 13:00 / 1:00 PM
UTC - 17:00 / 5:00 PM
BST - 18:00 / 6:00 PM
CEST - 19:00 / 7:00 PM
AEST - 03:00 / 03:00 AM / July 21st
To accommodate for different preferences the stream will be available simultaneously on both YouTube and a self-hosted instance of Owncast.
https://www.youtube.com/watch?v=56-DCAHU29Y
https://sideofburritos.com/live/

2026-07-19 14:30:16 CEST

- reply

@nprofile…trls Check the battery stats for any obvious culprits.
Try all of the advice in https://discuss.grapheneos.org/d/35721-grapheneos-power-usage-recommendations too.

2026-07-18 11:22:05 CEST

- reply

@nprofile…05ad It's one of Startpage's settings. It's not compatible with Chromium's Open Search metadata requirements for adding it as a search engine in the default mode.

2026-07-18 11:09:32 CEST

- reply

@nprofile…05ad You can add it as a search engine by setting it to GET mode, using it and then adding it as one in the search engine menu. There will be a better search engine menu soon.

2026-07-18 04:44:23 CEST

- reply

@nprofile…8rxv Facebook has gradually regressed support for using WhatsApp without Google services. It should still largely work without it but not as well as before. It works very well with sandboxed Google Play though. Have you tried using the per-app exploit protection compatibility mode for it?

2026-07-18 04:44:03 CEST

- reply

@nprofile…8rxv Facebook has gradually regressed support for using WhatsApp without Google services. It should still partially work without it though. It works very well with sandboxed Google Play. Have you tried using the per-app exploit protection compatibility mode for it?

2026-07-18 04:42:42 CEST

Vanadium version 151.0.7922.29.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.29.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/40463-vanadium-version-15107922290-released
#GrapheneOS #privacy #security #browser

2026-07-18 02:35:38 CEST

- reply

@nprofile…qujm @nprofile…ynd9 Royal Bank of Canada app does normally work but might require some compatibility toggles. Do you mean something else?

2026-07-17 22:39:18 CEST

- reply

@nprofile…ynd9 We've gradually eliminated nearly every case of apps being incompatible with GrapheneOS other than the Play Integrity device and strong integrity level.
GrapheneOS shows a notification each time apps use Play Integrity by default with the option to block using it. That helps to rule it out as a reason apps aren't working. Blocking it is also sometimes able to bypass it for services not yet enforcing providing a result. Play Integrity is the only significant remaining compatibility issue.

2026-07-17 22:38:59 CEST

- reply

@nprofile…ynd9 We've gradually eliminated nearly every case of apps being incompatible with GrapheneOS other than the Play Integrity device and strong integrity level.
GrapheneOS shows a notification each time apps use Play Integrity by default with the option to block using it. That helps to rule it out as a reason apps aren't working. Blocking it is also sometimes able to bypass it for services not yet enforcing providing a result. Play Integrity API is the only major remaining compatibility issue.

2026-07-17 20:29:10 CEST

- reply

@nprofile…u4e3 Both apps are compatible with GrapheneOS. Neither is banning using a non-Google-certified OS with the Play Integrity API.
https://grapheneos.social/@GrapheneOS/116936668043273041
Both the device integrity level and strong integrity level ban GrapheneOS. Device integrity level isn't equivalent to the strong integrity level but it does require hardware attestation to pass on devices known to have a working implementation. Device integrity does have the huge loophole of permitting hardware attestation to be unavailable.

2026-07-17 20:27:24 CEST

- reply

@nprofile…f8hd Both apps are compatible with GrapheneOS. Neither is banning using a non-Google-certified OS with the Play Integrity API.
https://grapheneos.social/@GrapheneOS/116936668043273041

2026-07-17 20:26:43 CEST

- reply

@nprofile…hett Both apps are compatible with GrapheneOS. Neither is banning using a non-Google-certified OS with the Play Integrity API.
https://grapheneos.social/@GrapheneOS/116936668043273041

2026-07-17 20:24:42 CEST

- reply

@nprofile…zjvd It's likely possible but we haven't looked into it deeply and it's likely largely implemented in Google Play services. It could potentially be supported in a similar way to how we support Android Auto as a sandboxed app with toggles to grant limited special privileges to it. We could also theoretically make our own implementation of either of those but that would be a lot of work. There's a reason it has taken Google so long to ship it. It's certainly possible to do it.

2026-07-17 20:22:41 CEST

- reply

@nprofile…ynd9 Play Integrity API wrongly conflates Google certification with security. GrapheneOS is far more secure than any OS certified by Google. It wrongly conflates GrapheneOS with typical alternative operating systems not preserving the standard security model, features and patches despite GrapheneOS doing the opposite. It also gives a free pass to any Google certified OS being indefinitely behind on security patches with the exception of an extremely weak standard for the strong integrity level.

2026-07-17 20:12:31 CEST

- reply

@nprofile…ynd9 Both of these apps work on GrapheneOS. Nearly every Android app is compatible with GrapheneOS. Only a small number banning using any non-Google-certified OS with the Play Integrity API are unavailable. Neither of these apps does that.
GrapheneOS fully preserves the standard security model and features including hardware-based security features. It greatly improves privacy and security with major privacy and security features. It stays far ahead of any other Android-based OS on updates.

2026-07-16 21:16:54 CEST

- reply

We already have a notification for apps using the Play Integrity API and can start detecting these libraries consistently causing compatibility issues to warn users about it. These notifications can have a shortcut for leaving a Play Store review for users with the sandboxed Play Store installed.

2026-07-16 21:12:12 CEST

V-Key's libraries depend on private APIs and implementation details. This causes compatibility issues with new Android releases, OEM changes and GrapheneOS security protections. We're now aware of it and worked around the known compatibility issues. However, they need to start fixing it themselves.

2026-07-16 18:29:00 CEST

GrapheneOS version 2026071500 released:
https://grapheneos.org/releases#2026071500
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/40416-grapheneos-version-2026071500-released
#GrapheneOS #privacy #security

2026-07-16 14:17:07 CEST

- reply

@nprofile…u4h7 It appears to be a battery failure. That's showing the hardware/firmware level charge screen which is displayed when the device has a little bit of power but not enough to boot the OS yet. Use a wall charger with proper USB-PD support, a good USB cable and try pressing the power button to pause booting when it starts booting the OS to avoid it wasting power and running out. It's probably just dead without a new battery though.

2026-07-15 21:55:18 CEST

- reply

@nprofile…d9jm No, since that's using the Play Integrity API.

2026-07-15 20:54:05 CEST

- reply

We've resolved the new compatibility issues with anti-tampering code in banking apps. We're in the process of making a new release with the workarounds. We posted a new thread about it:
https://grapheneos.social/@GrapheneOS/116925427491681935

2026-07-15 20:51:13 CEST

- reply

You can see the relevant changes here:
https://github.com/GrapheneOS/platform_frameworks_base/pull/410
https://github.com/GrapheneOS/platform_system_core/pull/43

2026-07-15 20:50:18 CEST

- reply

Our new secure spawning improved overall app compatibility despite these 2 anti-tampering SDKs causing new issues with it. We've solved the regressiond and are currently building a new release with the improvements. It will be available in around 12 hours. App compatibility will be better than ever.

2026-07-15 20:46:12 CEST

- reply

Our new secure spawning implementation has better app compatibility. This made it possible for the V-KEY V-OS Mobile App Protection anti-tampering SDK to run instead of crashing and it began blocking GrapheneOS. We've solved this problem by simply blocking their code from running for the time being.

2026-07-15 20:43:10 CEST

- reply

Our new secure spawning also added a per-app toggle. Alongside this, we made is possible to disable secure spawning and hardened_malloc at the same time. This requires an extra zygote with hardened_malloc disabled which we spawned on-demand. It has to be spawned at boot instead for low mount IDs.

2026-07-15 20:39:42 CEST

- reply

Our new secure spawning implementations runs the same code run by the Zygote after exec to improve compatibility. Many apps which didn't work before are now compatible. However, that tripped this mount ID check by recreating a mount namespace. It doesn't need that part so we've simply removed it.

2026-07-15 20:33:54 CEST

We solved the recent regression in compatibility with a small subset of banking apps. It was caused by a Zimperium anti-tampering SDK checking the Linux kernel mount ID for /system/framework/framework.jar and banning it being above 900. Our new secure spawning was tripping it.

2026-07-15 20:28:44 CEST

- reply

We've resolved the issue. See our new thread about it:
https://grapheneos.social/@GrapheneOS/116925334629738010

2026-07-15 20:28:11 CEST

- reply

This SDK checks the mount ID for /system/framework/framework.jar and disallows the ID being above 900. They use this to detect mounts created by Magisk and similar software. We've changed our new secure spawning related code to always create this mount namespace in early boot.

2026-07-15 20:21:06 CEST

- reply

This SDK checks the mount ID for /system/framework/framework.jar and blocks using the apps if it's above 900. They use this to detect mounts created by Magisk and similar software. We don't need mount namespaces for sandboxing due to SELinux so it can be easily worked around.

2026-07-15 20:20:37 CEST

- reply

2026-07-15 20:14:12 CEST

- reply

We solved the recent regression in compatibility with a small subset of banking apps. It was caused by the V-KEY V-OS Mobile App Protection SDK. It checks Linux mount IDs and breaks if mount namespaces are created after early boot. We've started builds for a new release already.

2026-07-15 20:10:17 CEST

2026-07-15 16:55:50 CEST

- reply

@nprofile…y26f Motorola flagships with GrapheneOS support will likely be available in 2027, hopefully within 12 months. It will take longer for lower end devices to be supported. The initial devices will be more expensive than most Pixels but it will end up supporting devices in a similar price range as Pixels including the 'a' series devices over time.

2026-07-15 15:36:36 CEST

- reply

@nprofile…znt3 @nprofile…quyq That may require an OS change if it's based on it being the system gallery app.

2026-07-15 15:35:07 CEST

- reply

@nprofile…kj8p Revolut should currently work fine on GrapheneOS but they may ban it in the future with the Play Integrity API. We'll have to do a pressure campaign to get them to unban it if that happens. We suspect it will happen because we had to work around an SDK in the Revolut app which was explicitly banning using GrapheneOS. It was even detecting the string "grapheneos" as the build user for the OS which we had set for reproducible builds. We had to change that and other things it checked.

2026-07-15 02:42:41 CEST

- reply

@nprofile…quyq We're going to be completely replacing the legacy AOSP Gallery with a much more modern app in the near future. Our Camera app will also get a major overhaul with many new features and a new user interface. The current Gallery isn't our own app but rather a legacy AOSP sample app and is awful but it's going to be gone soon.

2026-07-15 00:16:13 CEST

- reply

@nprofile…06ud The system would be fine if it was open sourced after a week instead of typically taking 2-4 months and sometimes longer.
It's worth noting security preview patches include patches to external projects. These patches aren't only for things Android uses. Some are publicly disclosed elsewhere already while others are not. There have been patches from Android security previews for projects used outside Android shipped in GrapheneOS according to the rules prior to disclosure elsewhere.

2026-07-15 00:13:47 CEST

- reply

@nprofile…06ud It's done because OEMs are so terrible at shipping patches. They started off giving them 30 days of early embargoed access but it wasn't enough and OEMs found it too difficult to ship patches each month. It also put users at risk from having it broadly disclosed for 30 days.
The new system allows every OEM to ship the patches without an embargo as GrapheneOS does while papering over OEMs taking many months to ship it. It's more secure when used well and covers up the failures.

2026-07-15 00:09:44 CEST

Vanadium version 150.0.7871.124.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.124.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/40347-vanadium-version-150078711240-released
#GrapheneOS #privacy #security #browser

2026-07-14 22:14:38 CEST

- reply

@nprofile…a4ar NFC payments work in apps not using the Play Integrity API to ban alternatives to Google Mobile Services Android.
Tap-to-pay works in Curve Pay, PayPal and many European banking apps. We aren't currently aware of an option available outside of Europe.

2026-07-14 21:01:24 CEST

- reply

We found one anti-tampering SDK was crashing due to being incompatible with secure (exec-based) spawning and therefore permitting having any OS. By fixing compatibility with it, we enabled it to detect and ban GrapheneOS. We'll fix that too. Banking app code is ultra low quality.

2026-07-14 20:59:05 CEST

- reply

In some cases, we've found the issue is that the anti-tampering code was previously crashing due to being incompatible with the previous secure spawning implementation so it wasn't banning GrapheneOS. By improving compatibility with it, we enabled it to ban GrapheneOS. We'll fix that problem too.

2026-07-14 20:57:04 CEST

- reply

@nprofile…3jn2 Their anti-tampering code is very broken. It started banning GrapheneOS due to some kind of change tied to the new secure spawning implementation but it can be stopped by breaking it using a VPN.
It's possible the anti-tampering code was completely broken by using secure spawning with the previous implementation but the new implementation improved compatibility with it which enabled it to ban GrapheneOS.

2026-07-14 20:45:19 CEST

- reply

Our per-app compatibility mode and the finer-grained toggles it uses can be used to work around most broken anti-tampering code. Our new per-app secure spawning toggle made it better. We need to fix the new compatibility issue with another flawed anti-tampering SDK though.

2026-07-14 20:38:10 CEST

- reply

These apps have poor security and instead deploy half-baked anti-tampering mechanisms with memory corruption bugs and many dependencies on implementation details changing between Android releases. It's why these apps usually break on new major Android versions until they upgrade.

2026-07-14 20:36:55 CEST

- reply

The new secure spawning implementation uncovered some more of these strange cases of apps banning GrapheneOS for obscure reasons. Since multiple users are reporting using a VPN set to another country works around it for Chase, that's worth trying as a workaround for others too.

2026-07-14 20:35:48 CEST

- reply

Our new secure spawning implementation improved overall app compatibility but there are still apps detecting differences from the stock OS and banning GrapheneOS. One cause we've discovered are apps counting the number of memory pages considered shared and banning having too few.

2026-07-14 20:34:39 CEST

Our users are reporting the Chase banking app is banning using GrapheneOS but permits it when a VPN is enabled and set to another country:
https://discuss.grapheneos.org/d/40289-chase-app-error-on-latest-graphene-version
We're aware of this compatibility issue with several apps and are actively working on improvements to resolve it.

2026-07-14 15:08:40 CEST

- reply

@nprofile…ud5y No, those EU standards don't require providing reasonable security patches. We've been pointing out how flawed those standards are for years. Android was already only backporting High and Critical severity patches to older releases which was in full compliance with the regulations. Further reducing how much gets backported is still in compliance. The regulations only require OEMs to do what Google defines as the bare minimum and Google has heavily watered down the standard patches.

2026-07-14 15:07:41 CEST

- reply

@nprofile…06ud We aren't happy about it because we want to be able to quickly provide the full set of patches in our regular releases. It's ridiculous having the patches not disclosed as open source for months. It should be a week at most, ideally significantly less than that. Our plan is to start having people reverse engineer patches from binary which can then be merged into the regular releases if it's done correctly. We aren't quite ready to get started on shipping them that way but we plan to.

2026-07-14 15:06:35 CEST

- reply

@nprofile…06ud GrapheneOS is already the only way to get all of the Android security preview patches early. Samsung flagships and Pixels ship a subset early but much more slowly than we do and they don't ship all of them. We get all of the security preview patches integrated and tested quite quickly. It's already a unique feature of GrapheneOS giving it yet another major privacy and security advantage over every other Android variant. We strongly recommend everyone uses the security preview releases.

2026-07-14 15:05:16 CEST

- reply

@nprofile…06ud We have full access to the security preview patches providing the Android Security Bulletin patches 2-6 months ahead. We ship the full set of relevant patches in our security preview releases. Each of our regular releases has a corresponding security preview releases. Our release notes provide a list of the included security preview patches. You can see how many patches are added in our security preview releases in our release notes listing those at the bottom:
https://grapheneos.org/releases#2026071100

2026-07-14 15:02:05 CEST

- reply

@nprofile…n6nv We have an unused @nprofile…8d0p account on Instagram to reserve the name. Every other account on Instagram using the GrapheneOS name is impersonating the project. There are many of those accounts impersonating us to sell sketchy devices supposedly running GrapheneOS. It's why we made the placeholder account to reserve the main name.

2026-07-14 15:00:19 CEST

- reply

@nprofile…ud5y No, those EU standards don't require providing reasonable security patches. We've been pointing out how useless the standards are for years. Android was already only backporting High and Critical severity patches to older releases which was in full compliance with the regulations. Further reducing how much gets backported is still in compliance. It requires that OEMs ship the extremely incomplete backports deemed to be the standard ones and slowly update the OS version too.

2026-07-14 05:02:58 CEST

- reply

Google needs to start open sourcing QPR1 and QPR3 releases again along with open sourcing security preview patches shortly after disclosure to OEMs. Otherwise, we'll just hire people to start doing reverse engineering work in an official capacity to start publishing the changes as open source early.

2026-07-14 04:56:37 CEST

- reply

Google switched to a performative Android Security Bulletin system with vulnerabilities listed 2-4 months after they're shipped. They're pretending as if not open sourcing patches protects people from OEMs not patching them. Our community has people successfully reverse engineering binary patches.

2026-07-14 04:55:01 CEST

- reply

Google is completely overwhelmed by the massive torrent of vulnerabilities discovered by AI models. They've done repeated cycles of layoffs and buyouts crippling their ability to handle it. The change to the schedule for Android Security Bulletins is also extremely at odds with this new reality.

2026-07-14 04:50:52 CEST

- reply

We're going to need to do a lot of work with Motorola and Qualcomm to provide serious patches for GrapheneOS devices. We're going to need more developers. After the launch of the new devices with GrapheneOS support, we want to repeatedly port to the latest Linux LTS branch among other major changes.

2026-07-14 04:47:07 CEST

- reply

Vast majority of Linux kernel vulnerabilities aren't covered by Android Security Bulletins, externally disclosed patches are backported very slowly and Android Security Bulletins come 2-4 months later than when Android patches can be shipped. If you want bare minimum patches, use iOS or GrapheneOS.

2026-07-14 04:44:43 CEST

- reply

Android 17 is the only Android release with the current set of disclosed Moderate and Low severity patches. Android 16, 16 QPR2 and 17 will soon be the only releases with the current set of disclosed Critical and High severity patches too. Once Android 18 is released, it will be the only one.

2026-07-14 04:43:34 CEST

- reply

Bare minimum Android security patches now require being on Android 16, 16 QPR2 or 17 and quickly moving to Android 18 when it's released. Once Android 18 is released, it will be the only release with current High and Critical severity patches. Serious support for older Android releases has ended.

2026-07-14 04:41:43 CEST

- reply

The vast majority of vulnerabilities are now being discovered internally by Google for Android and Chrome. These are largely being discovered with AI. The subset deemed Critical severity and an imminent risk will be backported to 16 and 17. Bare minimum security support for older releases is over.

2026-07-14 04:37:55 CEST

- reply

Android Security Bulletins already omit Moderate and Low severity patches. They're already dated 2-4 months after the vulnerabilities were disclosed to OEMs and allowed to be shipped. Only Samsung flagships and Pixels ship any of it 'early' on practice. Only GrapheneOS ships the full set 'early'.

2026-07-14 04:34:05 CEST

- reply

Externally reported vulnerabilities will currently still follow the same policy for backports as before. High and Critical severity vulnerabilities reported to Google by external parties will be backported to releases going back around 3 years (currently 14, 15, 16 and the current latest stable 17).

2026-07-14 04:31:10 CEST

- reply

Google recently informed OEMs of greatly reduced security support for older releases of Android. For the vast majority of discovered vulnerabilities, only Critical severity issues deemed to be an imminent risk will be backported at all and only to the most recent 2 major yearly releases (16 and 17).

2026-07-14 04:26:39 CEST

Android's security policy for the past several years has been to backport patches for Critical and High severity Android vulnerabilities to the past 3 major yearly releases. Moderate and Low severity patches including most fixes for privacy weaknesses have required upgrading to the latest releases.

2026-07-12 17:08:08 CEST

- reply

@nprofile…v2us By default, GrapheneOS runs exec after fork from the zygote processes in order to create a fresh address space with a per-process randomized address space layout, randomized heap layout, random canaries, random memory tags and other per-process state. It substantially improves security especially when combined with the extensive usage of hardware memory tagging on GrapheneOS. Exec-based spawning was one of the earliest GrapheneOS features added in 2014.

2026-07-12 03:41:22 CEST

GrapheneOS version 2026071100 released:
https://grapheneos.org/releases#2026071100
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/39301-grapheneos-version-2026071100-released
#GrapheneOS #privacy #security

2026-07-12 00:19:03 CEST

- reply

@nprofile…2d2w You can see the account which replied to you is a single purpose account created for the sole purpose of attacking the GrapheneOS project: It was created on July 9th and now has 4 posts downplaying the ongoing attacks across platforms and engaging in trolling. The account goes out of the way to act as a juvenile troll while downplaying extremely malicious misinformation, libel and harassment as being people joking around. It's a very serious situation including real world attacks.

2026-07-12 00:15:45 CEST

- reply

@nprofile…2d2w You can see the account which replied to you is a single purpose account created for the sole purpose of attacking the GrapheneOS project: It was created on July 9th and now has 4 posts downplaying the ongoing attacks across platforms and engaging in trolling. That account is a clear example of a troll, but that's not most of what we're experiencing. Most of the attacks on GrapheneOS are malicious misinformation and harassment aimed at others and they don't want us responding.

2026-07-11 22:35:28 CEST

- reply

@nprofile…lezl @nprofile…v43s It even has optional GPU acceleration support via gfxstream and will eventually have support for hardware GPU acceleration support.
Desktop mode and virtualization of other operating systems are both going to get much better. Android is moving towards replacing ChromeOS and that functionality is going to be available in GrapheneOS too. We also plan to improve it.

2026-07-11 22:30:08 CEST

- reply

@nprofile…lezl @nprofile…v43s GrapheneOS has DisplayPort alternate mode and the standard Android 17 desktop mode. It has always been able to use a mouse, keyboard, game controller, etc.
There's also the standard hardware-based virtualization support including the experimental Terminal app for managing virtual machines running other operating systems. That has GUI and audio input/output support.