GrapheneOS [Unofficial]

Changes in version 134.0.6998.135.0:

Tags:

Android 15 QPR2 introduced a bug where the Microphone indicator will sometimes remain active after Microphone usage ends. We've confirmed this issue is present in the stock Pixel OS for both Android 15 QPR2 and Android 16 Beta 3. We're working resolving the regression but haven't figured it out yet.

Second donation to GrapheneOS by the Proton Foundation:

Latest release of Vanadium has support for passkeys without Google Play services via the Android 15 credential manager:

Chromium team developed a new font rendering library (Skrifa) as part of their Fontations library written in Rust. Skrifa now provides memory safe rendering for all web fonts since Chromium 133 for Android, ChromeOS and other Linux distributions:

Changes in version 134.0.6998.108.0:

Tags:

This release greatly improves the experimental virtual machine management app with many backports from the Android Open Source Project main branch. You'll need to install Android's latest Debian-based image in order to continue using it. You'll be prompted to do this at startup after it fails to start with the old setup with an opportunity to back up the data. The data inside it should continue to be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update.

Notable changes in version 83:

Our 2025030900 release currently in the Beta channel is the first one with support for managing hardware-based virtual machines via the Terminal app in Android 15 QPR2. Since then, we've backported massive improvements to the feature for an upcoming new release, maybe even today.

Changes in version 134.0.6998.95.0:

This release adds support for the experimental virtual machine management app introduced in Android 15 QPR2. It currently only provides support for managing a single VM and interacting with it via a WebView-based terminal. Android is in the process of adding support for graphics and GPU acceleration for a future release. For now, it's only available in developer options due to being highly experimental. We don't recommend using developer options on a production device, but you can temporarily enable it to turn on this feature and turn them back off without it being disabled like most developer options. The data inside it should currently be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update. We plan to support choosing other guest operating systems beyond the Debian-based image provided by Android along with taking far more advantage of the virtualization infrastructure.

For our next release after 2025030800, we've added support for the Android 15 QPR2 Terminal for running other operating systems using hardware virtualization. It's currently only a terminal but Android is adding support for graphics and GPU acceleration for a future release.

Workaround for very rare fingerprint firmware glitch with Android 15 QPR2:

Tags:

Since 6th/7th/8th generation Pixels have moved to the Linux 6.1 LTS branch with Android 15 QPR2 from 5.10 (6th/7th gen) and 5.15 (8th gen), we've closed issues filed about kernel crashes for those devices. Many kernel bugs will be gone and any remaining ones need updated reports.

Tags:

Notable changes in version 82:

So far, the only release blocking regression reported for our port to Android 15 QPR2 is the main user interface for setting the wallpaper not loading. This has blocked it reaching the Beta and Stable channels but we'll get it quickly resolved and another release pushed out.

This release is based on Android 15 QPR2, the second quarterly release of Android 15. All of the supported devices are now using the Linux 6.1 LTS branch so the 5.10 and 5.15 branches are retired for GrapheneOS. 6.6 continues to be used for microdroid virtual machines on devices and for emulator builds, which will likely move to 6.12 this year.

The stable release of Android 15 QPR2 is coming out today. Since around the same time last year with Android 14 QPR2, quarterly releases have been trunk-based which means they ship the development branch changes. It's a large release similar to a yearly release under the hood.

Since this month's release of Android isn't available yet, we're currently building/testing an early March security update release providing the Android Security Bulletin backports of High/Critical severity patches. Android 15 QPR2 will be available in the near future though.

This is an early March security update release based on the March 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR2) scheduled for this month hasn't been published yet.

Our network location implementation's 3D trilateration is using far too much CPU so we're going to temporarily downgrade back to 2D until we heavily optimize it. We'll make an efficient Rust implementation to replace the initial Kotlin code and we'll see how fast we can make it.

Notable changes in version 30:

Notable changes in version 29:

Tags:

Tags:

Tags:

https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/

Tags:

Changes in version 134.0.6998.39.0:

Changes in version 133.0.6943.137.0:

Notable changes in version 26:

Notable changes in version 81:

Notable changes in version 24:

Notable changes in version 24:

Notable changes in version 80:

Changes in version 133.0.6943.121.0:

Notable changes in version 79:

Notable changes in version 28:

Notable changes in version 23:

Notable changes in version 27:

Initial out-of-band update with dependency updates and under-the-hood modernization.

Notable changes in version 22:

Notable changes in version 21:

Changes in version 133.0.6943.89.0:

Our Mastodon server stopped working after around 22:37 UTC time yesterday. It appears Mastodon spun out of control consuming lots of CPU, disk and memory. It locked up the server with a massive amount of I/O. There isn't a lot of information about what happened since logging stopped persisting to storage shortly after it started. It was quickly detected by our service monitoring but we just weren't around to fix it for 7 hours. It's working again after a server restart but nothing was changed.

Tags:

The functionality provided by Google's new Android System SafetyCore app available through the Play Store is covered here:

Notable changes in version 78:

In April 2024, Pixels shipped a partial implementation of our January 2024 proposal for firmware-based reset attack protection. Fastboot mode now zeroes RAM before enabling USB. This successfully wiped out the After First Unlock state exploit capabilities of two commercial exploit tools.

Tags:

Yesterday (2025-02-03), we released an early update based on the Android Security Bulletin backports of High/Critical severity vulnerabilities to older Android Open Source Project releases. The actual monthly AOSP and Pixel update was published today and we're building that now.

Changes in version 133.0.6943.49.0:

Changes in version 154:

This is an early February security update release based on the February 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.

February 2025 Android Security Bulletin includes a heap buffer overflow in a Linux kernel USB peripheral driver (CVE-2024-53104) marked exploited in the wild. It's likely one of the USB bugs exploited by forensic data extraction tools. We block them using these.

Tags:

Changes in version 133.0.6943.39.1:

Our next OS release has support for enabling and using Google's credential service via sandboxed Google Play by making it an unprivileged service. This has become a requirement for the "Sign in with Google" option in a subset of apps although most provide a least one alternative.

Tags:

Changes in version 133.0.6943.39.0:

Changes in version 132.0.6834.163.0:

A post from the developer of WireGuard on the severe security flaws and lack of trustworthiness of F-Droid:

Tags:

Changes in version 153:

Android's Private DNS feature originally used DNS-over-TLS (DoT) before Google decided to focus on DNS-over-HTTPS (DoH) over DoT or the newer DNS-over-QUIC (DoQ).

Revolut is specifically banning GrapheneOS by checking for the build machine hostname and username being set to grapheneos. We've changed these to build-host and build-user. Combined with another change, this allow our users to log in to it again until they roll out Play Integrity API enforcement.

Changes in version 138:

A chat server running on powerful hardware collapsing when handling more than 100 events per second isn't acceptable. Events scale up based on room activity from non-local users including spammers too. It's an issue for a server with 12 users too.

Changes in version 132.0.6834.79.2:

Android uses Clang type-based forward edge Control Flow Integrity (CFI) for the kernel and a subset of userspace. It isn't a high impact security feature. We used to have changes expanding userspace coverage but Android is already doing it and we moved this effort to higher impact work.

Tags:

Changes in version 132.0.6834.79.0:

Chromium 132.0.6834.79 moved from early stable to stable today. This is unusual since there's usually a bug fix release after a week of early stable instead of it ever moving directly into the stable channel. There will be a new Vanadium release shortly.

We've implemented a system for notifying users when apps use the Play Integrity API. This will help users determine which apps are banning using a non-stock OS. Some of these will still work if they only enforce basic integrity rather than requiring a Google certified device running the stock OS.

Tags:

Changes in version 131.0.6778.260.0:

The monthly update for AOSP and the stock Pixel OS was released today along with a Chromium update. We're currently building the Chromium update and then we'll build the OS release. They haven't pushed kernel tags for the new OS release to AOSP yet so we can't start yet anyway.

Notable changes in version 77:

Now that DivestOS is discontinued, it's possible another project will take on their goal of harm reduction for end-of-life devices. DivestOS was started before Treble, Generic Kernel Images and other improvements making device support far easier. A new project should avoid being based on LineageOS.

Notable changes in version 76:

Tags:

Our 2-factor fingerprint unlock feature is now fully implemented and will be available in the upcoming GrapheneOS release. This adds the option to set a PIN for using fingerprint unlock. You can use a strong diceware passphrase as the primary unlock method with fingerprint+PIN secondary unlock.

There was a short-lived issue with our app repository causing an error when trying to update sandboxed Google Play from our App Store. You can ignore it and let it update automatically or manually refresh and update it now. We'll implement checks to avoid it happening again.

Changes in version 131.0.6778.200.0:

An issue was filed on our Vanadium issue tracker about a potential Chromium WebRTC privacy issue. It was filed to track our process of determining whether we needed to do something about it with a privacy enhancement in GrapheneOS. We ended up deciding not to make a change to it.

Changes in version 152:

Notable changes in version 75:

Tags:

We're very disappointed Let's Encrypt is ending support for proper revocation checks via OCSP Must-Staple which is the only efficient, private and secure method not depending on a browser-specific service:

Changes in version 131.0.6778.135.0:

Android 15 QPR1 introduced a bug requiring the Microphone (record audio) permission for routing local audio too. It impacts Android Auto on both GrapheneOS and stock OS, but only users on GrapheneOS will notice it because the permissions aren't granted by default.

Tags:

We've added an initial section to our site with a list of apps explicitly banning using GrapheneOS via the Play Integrity API with links to their Play Store pages:

Google's Play Integrity API is not a security feature but rather it pretends to be one. Both Apple and Google are failing to protect their users against real world commercial exploit tools. Banning using one of the only options people have for better protection is anti-security.

Unfortunately, Revolut has banned GrapheneOS users from logging into the app because of an incorrectly implemented device integrity check based on the anti-competitive Play Integrity API. Our users need to put pressure on apps like this to get them to whitelist GrapheneOS.