Official releases of GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.https://grapheneos.org/releases#2023050100<section id="changelog" morss_own_score="6.382360222088623" morss_score="682.5076326339804"><h2><a href="https://grapheneos.org/releases#changelog">Changelog</a></h2><p>List of tagged releases. Snapshot releases without tags such as early releases of the project and early device support releases are not listed.</p><p>The changelog is also available as an <a href="https://grapheneos.org/releases.atom">atom feed</a> usable in any standard feed reader.</p><p>The <a href="https://grapheneos.org/history/legacy-changelog">legacy changelog page</a> has the release notes from before the rebranding of the project in 2018 and 2019.</p><article><h3><a href="https://grapheneos.org/releases#2026042100">2026042100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026042100">2026042100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040800 release:</p><ul><li>Launcher: backport fix from Pixel Launcher for the recents overview with third party launchers</li><li>Launcher: improve our implementation of hiding the app list when search is focused to more closely match Pixel Launcher</li><li>don't allow irregular secondary users (guest, demo or restricted) to have a private space</li><li>Settings: inherit user restrictions from full user to a nested private space and run a one-time task to add missing restrictions</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.167</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.1): backport SVE support for protected guests</li><li>kernel (6.1, 6.6, 6.12): backport fix for race conditions in USB gadget UVC driver causing crashes with the device as webcam feature including use-after-free detected by hardware memory tagging</li><li>kernel (6.6, 6.12): disable Android GKI vendor hooks for INIT_ON_FREE page zeroing to avoid Pixels deferring zero-on-free for reclaim (kswapd) via their driver tree since it reduces security to improve performance (the stock OS doesn't use INIT_ON_FREE but they tried to reduce the cost to be acceptable for the stock OS while we want the full security instead)</li><li>adevtool: change added Cape cellular radio carrier configuration entry to use USCC (1952) instead of ATT (1187) to avoid outbound call issues for users opting into using their new setup early (stock Pixel OS will add the same entry but they take months to handle it so it was submitted to us too)</li><li>hardened_malloc: improve handling of out-of-memory edge cases</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.101.0">version 147.0.7727.101.0</a></li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026042101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28585, CVE-2026-28586</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040800">2026040800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040800">2026040800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040600 release:</p><ul><li>full 2026-04-05 security patch level</li><li>update Pixel firmware, driver libraries, HALs and other components backported from Android 16 QPR3 from the initial March 2026 release to the April 2026 release (CP1A.260405.005)</li><li>Settings: ProfileSelectFragment: backport Android 16 QPR3 to ease future porting</li><li>Settings: ProfileSelectFragment: fix crash caused by upstream bug when opening credential settings from private profile</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.12): temporarily disable RANDSTRUCT and LTO due to incompatibility with Rust since Android has started using the Rust ashmem rewrite (CFI still works without LTO due to using kCFI)</li><li>kernel (6.12): switch to Rust ashmem implementation</li><li>kernel (6.12): enable building Rust Binder implementation</li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040600">2026040600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040600">2026040600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040300 release:</p><ul><li>full 2026-04-01 security patch level</li><li>make temporary biometric lockouts into permanent lockouts and ensure only framework can clear lockout to make sure our 5 attempt limit is always properly enforced across devices with different implementations of biometric unlock instead of batches of 5 temporary lockouts followed by permanent lockout after 20 attempts</li><li>Launcher: fix layout for search bar which is broken in upstream AOSP due to lack of a predictive service</li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040300">2026040300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040300">2026040300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026032000 release:</p><ul><li>Keyboard: add heuristic for detecting the input field is a Jetpack Compose TextField to work around a bug in Compose's implementation breaking backspace functionality by falling back to a legacy approach</li><li>fix upstream use-after-free bug caught by MTE in the Pixel HWC3 service when an external display connects which causes soft reboots</li><li>fix StrictMode BackgroundActivityLaunchCallback leak which was leading to exhaustion of the binder proxy object limit causing a crash</li><li>Contact Scopes: resolve app compatibility issue causing crashes due to missing handling for _count queries when scopes are empty</li><li>Sandboxed Google Play compatibility layer: improve the user experience for using Google Messages RCS by showing users the access it requires is being requested along with overhauling the implementation</li><li>Sandboxed Google Play compatibility layer: permit Android Auto retrieving A2DP connection policy when the special access permission for wireless Android Auto is granted to improve compatibility beyond the stub in GmsCompatConfig version 169</li><li>Pixel 10a: add missing Multiuser app for multi-user switcher widget</li><li>Pixel 10a: backport Android 16 QPR3 GNSS HAL to resolve a mismatch resulting in inaccurate GNSS data</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.129</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.77</li><li>adevtool: update the cellular modem carrier configuration database for Cape to fix VoWifi support prior to the change shipping in the stock Pixel OS</li><li>adevtool: heavily optimize carrier config decoding</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-168">version 168</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-169">version 169</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.164.0">version 146.0.7680.164.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.24.0">version 147.0.7727.24.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.0">version 147.0.7727.49.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.1">version 147.0.7727.49.1</a></li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026032000">2026032000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026032000">2026032000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026030700 release:</p><ul><li>add experimental Pixel 10a support</li><li>Launcher: change app drawer search bar to cancelling search when the back action is invoked instead of the query becoming empty</li><li>backport SELinux policy for CameraX extensions property used by the Pixel Camera HAL from Android 16 QPR3</li><li>hardened_malloc: multiple small optimizations to improve performance</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.166</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.127</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.76</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.65.1">version 146.0.7680.65.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.111.0">version 146.0.7680.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.115.0">version 146.0.7680.115.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.119.0">version 146.0.7680.119.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.153.0">version 146.0.7680.153.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/91">version 91</a></li><li>switch to cross-device gmscompat_lib key for 10th gen Pixels</li><li>adevtool: add support for keeping only certain unpacked images to help with constrained storage</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026032001 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030700">2026030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030700">2026030700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030500 release:</p><ul><li>update Pixel Camera HAL to CP1A.260305.018 (Android 16 QPR3) to resolve compatibility issues with the backported Android 16 QPR3 kernel drivers</li><li>Pixel 10 Pro Fold: change thermal info configuration to work around an incompatibility with the Android 16 QPR3 kernel device tree</li><li>Setup Wizard: add opt-in toggles for geocoding to the Location services page since we now have a GrapheneOS geocoding service able to handle a large number of users</li><li>replace "OpenStreetMaps" with the correct "OpenStreetMap" for the geocoder server option name</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.65.0">version 146.0.7680.65.0</a></li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030500">2026030500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030500">2026030500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030200 release:</p><ul><li>full 2026-03-05 security patch level</li><li>integrate extra security patches not included in the Android Security Bulletin from the March 2026 Android 16 security tag release</li><li>update Pixel kernel sources to CP1A.260305.018 (Android 16 QPR3)</li><li>update Pixel firmware and a large portion of the driver libraries/HALs to CP1A.260305.018 (Android 16 QPR3)</li><li>fix Network permission enforcement for MediaPlayerService clients by closing a bypass caused by an upstream Android vulnerability for INTERNET permission enforcement caused by using case-sensitive rather than case-insensitive string comparisons</li><li>rename geocoder options to "GrapheneOS server" and "OpenStreetMaps server" since we're now self-hosting Nominatim instead of providing a proxy to the OpenStreetMaps instance</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030200">2026030200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030200">2026030200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030100 release:</p><ul><li>full 2026-03-01 security patch level</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48649, CVE-2025-48652, CVE-2026-0016, CVE-2026-0018, CVE-2026-0022, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030100">2026030100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030100">2026030100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026021200 release:</p><ul><li>SystemUI: migrate to the modern lockscreen infrastructure (smartspace) for showing lockscreen device status info to avoid many upstream bugs caused by AOSP still using the legacy lockscreen infrastructure no longer used on the stock Pixel OS (this allows us to revert a bunch of downstream fixes we were using)</li><li>Settings: don't allow disabling eSIM when eSIM management support is disabled since it can persistently prevent using the eSIMs without using ADB shell to undo it</li><li>modify our multicast firewall to stop dropping route advertisements received on the VPN interface which sometimes breaks IPv6 connectivity</li><li>fix rare edge preventing dismissing the UI for our 2-factor fingerprint unlock feature</li><li>Setup Wizard: add opt-in toggles for network-based location and always available Wi-Fi scanning to the Location services page</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): raise lockdown mode from integrity to confidentiality mode to match the other devices</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): add workaround for an upstream arm64 KVM bug breaking booting with lockdown in confidentiality mode</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.163</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.126</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.73</li><li>hardened_malloc: update libdivide to 5.3.0</li><li>hardened_malloc: fix handling one form of realloc from small allocations made with alignment above PAGE_SIZE (no known real world examples and it would be crashing if it was happening since it causes internal invalid accesses unable to go outside the bounds of the protected metadata region which is mainly PROT_NONE)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.75.0">version 145.0.7632.75.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.109.0">version 145.0.7632.109.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.120.0">version 145.0.7632.120.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.31.0">version 146.0.7680.31.0</a></li><li>adevtool: handle Node.js fs.cp behavior change</li><li>adevtool: update dependencies</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2025-64783, CVE-2025-64784, CVE-2025-64893, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026021200">2026021200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026021200">2026021200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026020600 release:</p><ul><li>Sandboxed Google Play compatibility layer: add toggle for granting Play services access to ICC auth in order to support RCS with carriers requiring it for RCS in Google Messages including T-Mobile (see <a href="https://grapheneos.org/usage#rcs">RCS usage guide</a>)</li><li>Launcher: fix rare upstream crash when switching users</li><li>Dialer: add new opt-in implementation of call recording using the same framework APIs as Google Dialer with the goal of improving functionality (handover support) and robustness (currently an opt-in setting for testing and then it will replace the previous implementation)</li><li>kernel (6.1, 6.6, 6.12): re-enable standard forced module signing with a workaround to make pKVM compatible with it</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.162</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.123</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.69</li><li>change default quick tile configuration for the new UI (replacing cast, wallet and device controls with camera, microphone and NFC toggles by default)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.45.1">version 145.0.7632.45.1</a></li><li>update release signing to handle AOSP APEX changes</li><li>migrate otatools.zip changes to Android's modern build system (soong)</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026021201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026020600">2026020600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026020600">2026020600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026020400 release:</p><ul><li>raise declared Android security patch level to 2026-02-05 which has been provided since we moved to Android 16 QPR2 in December (was meant to be declared in the previous release)</li><li>add cross-SIM calling support (making calls using a SIM via the mobile data provided by another SIM similarly to Wi-Fi calling); requires Automatic data switching in SIM settings, and existing installs may need to toggle Automatic data switching off and on to enable cross-SIM calling</li><li>extend our carrier override feature with a toggle for forcing the availability of cross-SIM calling support</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.45.0">version 145.0.7632.45.0</a></li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026020601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026020400">2026020400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026020400">2026020400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026012800 release:</p><ul><li>raise declared Android security patch level to February 2026 which has been provided since we moved to Android 16 QPR2 in December (currently declared as 2026-02-01 even though 2026-02-05 has been provided since Android 16 QPR2 but it wasn't worth restarting the builds)</li><li>update to February 2026 Pixel driver/firmware code providing the 2026-02-05 Pixel security patch level</li><li>Dialer: fix call recording button state after fragment re-creation to avoid showing call recording as active when it isn't</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.121</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.26.0">version 145.0.7632.26.0</a></li><li>switch to 64-bit-only Vanadium releases for devices without 32-bit support (7th gen Pixels and later)</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/34">version 34</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/35">version 35</a></li><li>switch from 6.6 kernel branch to 6.12 kernel branch for emulator builds (used for development) to match AOSP since Android 16 QPR2</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026020401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026012800">2026012800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026012800">2026012800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026012100 release:</p><ul><li>FusedLocationProvider: restore pre-16-QPR1 GNSS usage policy of using GNSS for both balanced and high power requests instead of only high power requests since many GrapheneOS users don't enable network location and network location may not always be accessible such as temporarily not having internet access</li><li>Sandboxed Google Play compatibility layer: add special case for sandboxed Play services making it so users granting the SMS permission enables reading SMS addressed to apps using the Google Play services client library (Android 16 QPR2 prevented using the SMS permission to read SMS addressed to other apps so a special case is needed for apps which use Google Play services to handle SMS-based authentication)</li><li>Sandboxed Google Play compatibility layer: prevent sandboxed Play Store attempting to install the "Device configuration" package which is not used on GrapheneOS and serves no purpose</li><li>avoid compatibility issues with misguided anti-tampering checks in a tiny subset of apps by changing the initial call stack for secure app spawning (exec spawning) to match the standard zygote-based spawning so these apps no longer detect secure spawning as an altered call stack indicating tampering</li><li>Settings: require device restart after changing the secure app spawning setting</li><li>Sandboxed Google Play compatibility layer: update Android Auto configuration UI to Material 3 Expressive</li><li>add workaround for upstream system_server startUserInBackgroundTemporarily crash</li><li>fix GrapheneOS support for recording permission usage history for a broader set of permissions</li><li>Dialer: set CallStyle for call notifications to improve the user interface and replace our temporary workaround of disabling notification grouping for it</li><li>Network Location: rename "GrapheneOS proxy" option to "GrapheneOS Apple proxy" for clarity</li><li>Network Location: add "Apple China" server choice required for China data due to China's laws about mapping the country (currently no proxy due to poor connectivity to and from China causing reliability issues with connecting to Apple's servers in China from ours but we plan to offer it as an option in the future)</li><li>Pixel 8a, 9th gen Pixels and 10th gen Pixels: disable NTP usage in Samsung gnssd which isn't as useful on GrapheneOS due to reducing the system time update threshold from 2000ms to 50ms along with avoiding us needing to redirect this to our own NTP service as we did for Qualcomm xtra-daemon</li><li>update code for disabling reporting of harmless fingerprint-service.goodix crash</li><li>improve user interface for Network/Sensors permissions in the permission manager</li><li>fix minor Material 3 Expressive styling issues for the Contact Scopes and Storage Scopes configuration UI</li><li>adevtool: raise minimal supported Node.js version to 24</li><li>adevtool: disallow running adevtool as root</li><li>adevtool: check for presence of prebuilts dirs at startup</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.67</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.109.0">version 144.0.7559.109.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026012100">2026012100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026012100">2026012100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026011300 release:</p><ul><li>fix an upstream infinite loop bug in ProtoFieldFilter.skipBytes() causing an upstream system_server issue leading to the OS being unusable in early boot for a tiny subset of users since Android 16 QPR2 (there are a bunch of reports of these symptoms with the stock Pixel OS)</li><li>libpng: backport security patches</li><li>remove unused INTERNET permission from Pixel Camera Services since GrapheneOS doesn't support the Pixel Connected Cameras feature</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.161</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.66</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): enable lockdown in integrity mode which is a major step towards matching the other devices using it in confidentiality mode</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.59.0">version 144.0.7559.59.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.59.1">version 144.0.7559.59.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.76.0">version 144.0.7559.76.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.76.1">version 144.0.7559.76.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.90.0">version 144.0.7559.90.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0036</li><li>Unclassified: CVE-2026-0035</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026011300">2026011300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026011300">2026011300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026011000 release:</p><ul><li>update to January 2026 Pixel driver/firmware code for the subset of devices with a January 2026 release</li><li>allow user to set any account as the default contacts account (since Android 16 QPR1, this was restricted to Google accounts for the stock Pixel OS and nothing permitted at all for AOSP)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.159</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026011301 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026011000">2026011000</a></h3><p>Support for 10th gen Pixels is no longer considered experimental.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026011000">2026011000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026010800 release:</p><ul><li>reimplement the standard Android USB data signal API with our hardware + software USB blocking functionality to preserve support for the device admin and lockdown mode features for fully toggling off USB while upgrading it to use hardware blocking (this was omitted in the previous Alpha-only release)</li><li>fix regression in the last release causing sandboxed Google Play breakage in a subset of secondary users caused by the phenotype flag changes in the previous release</li><li>Sandboxed Google Play compatibility layer: add stub for ContentResolver.acquireUnstableProvider()</li><li>fix the Terminal virtual machine management app not working in a secondary user Private Space (GrapheneOS adds the ability to use the Terminal app in secondary users and also adds the ability to use Private Space in secondary users, so the combination of those things resulted in this being possible but the upstream code was incompatible with it)</li><li>Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold: add high EMF (PWM) mode opt-in to the Settings app</li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026011001 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026010800">2026010800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026010800">2026010800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025122500 release:</p><ul><li>raise declared Android security patch level to 2026-01-05 which has been provided since we moved to Android 16 QPR2 in December due to Pixels shipping CVE-2025-54957 in December</li><li>re-enable the system keyboard package at boot if the package is disabled (does not change keyboard settings)</li><li>switch to the system keyboard when device boots to the Safe Mode</li><li>add "Reboot to Safe Mode" power menu button in Before First Unlock state to make Safe Mode much more discoverable for working around app issues such as a broken third party keyboard</li><li>add workaround for upstream UsageStatsDatabase OOM system_server crash</li><li>add workaround for upstream WindowContext.finalize() system_server crash</li><li>disable buggy upstream disable_frozen_process_wakelocks feature causing system_server crashes for some users</li><li>Sandboxed Google Play compatibility layer: fix phenotype flags not working in Play services clients</li><li>Sandboxed Google Play compatibility layer: add MEDIA_CONTENT_CONTROL as a requested permission for Android Auto as part of our toggles for it to avoid needing to grant the far more invasive notification access permission</li><li>Sandboxed Google Play compatibility layer: extend opt-in Android Auto Bluetooth support to allow A2dpService.setConnectionPolicy() to fix Bluetooth functionality (previously worked around with a GmsCompatConfig update avoiding a crash)</li><li>switch to new upstream PackageInstallerUI implementation added in Android 16 QPR2 and port our changes to it</li><li>update SQLite to 3.50.6 LTS release</li><li>add an extra layer of USB port protection on 10th gen Pixels based on upstream functionality to replace our USB gadget control which was causing compatibility issues with the Pixel 10 USB drivers</li><li>allow SystemUI to access NFC service on 10th gen Pixels to fix the NFC quick tile</li><li>disable the upstream Android USB data protection feature since it conflicts with our more advanced approach and causes issues</li><li>issue CHARGING_ONLY_IMMEDIATE port control command in more cases</li><li>fix an issue in our infrastructure for spoofing permission self-checks breaking automatically reading SMS one-time codes for certain apps</li><li>add workaround for upstream KeySetManagerService system_server crash causing a user to be stuck on an old OS version due to it causing a boot failure when booting a the new OS version after updating</li><li>wipe DPM partition on 10th gen Pixels as part of installation as we do on earlier Pixels since it's always meant to be zeroed on production devices</li><li>Settings: disable indexing of the unsupported "Parental controls" setting which is not currently available in AOSP</li><li>Settings: disable redundant indexing of widgets on lockscreen contents which is already indexed another way</li><li>skip all pseudo kernel crash reports caused by device reboot to avoid various false positive crash reports</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.192.0">version 143.0.7499.192.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026010801 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025122500">2025122500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025122500">2025122500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121700 release:</p><ul><li>restore support for bypassing carriers disallowing choosing the cellular network mode (this was lost in a recent major version migration such as the port to Android 16 QPR1 but we aren't sure exactly when it regressed)</li><li>remove poorly designed upstream end session button on the lockscreen (it remains available in the power menu)</li><li>enable feature flag for new upstream end session button in the user switcher</li><li>switch to vendor files from 2nd December 2025 release (BP4A.251205.006.E1) for devices with it available</li><li>enable lockscreen widget support</li><li>fix upstream system_server crash in NotificationHistoryProtoHelper</li><li>Wi-Fi HAL: ignore debug logging requests on all Pixels with MTE support to avoid a crash from detecting an invalid memory access in the upstream code</li><li>Sandboxed Google Play compatibility layer: add support for redirecting Google Play location service requests from within Google Play services itself which means the GrapheneOS provided network location will work for internal Play services features such as Google Maps location sharing when redirecting to the OS is enabled (which is the default) and the Location permission is granted to it</li><li>Sandboxed Google Play compatibility layer: force redirecting Google Play location service requests from within Google Play services and Android Auto when the Location permission is disabled for better error handling (neither properly handles the Location permission not being granted since it's always granted on any Google Mobile Services OS in practice instead of being explicitly opt-in)</li><li>Sandboxed Google Play compatibility layer: fix a compatibility issue with the Chromium test suite</li><li>Network Location: improve position estability accuracy and stability</li><li>Network Location: prevent potential division by zero exception</li><li>Network Location: improve experimental Wi-Fi RTT support which is still disabled in production</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.119</li><li>kernel (6.6): disable CONFIG_TLS to reduce attack surface</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.63</li><li>kernel (6.12): disable CONFIG_TLS to reduce attack surface</li><li>include configuration for thermometer on 10th gen Pixels</li><li>adevtool: auto-detect filesystem image type (ext4 vs. EROFS)</li><li>adevtool: add support for canary builds</li><li>adevtool: improve performance</li><li>remove obsolete workaround for using a prebuilt recovery extension</li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025122501 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121700">2025121700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121700">2025121700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121200 release:</p><ul><li>add workaround for upstream system_server WallpaperManagerService.hasPermission() crash</li><li>fix upstream system_server crash in NotificationHistory.getPooledStringsToWrite()</li><li>Launcher: add a workaround for upstream QuickstepModelDelegate.getContainer() crash</li><li>set initial port security state at an earlier boot stage to improve debugging on production builds where the port state has been changed from the default "Charging-only when locked" to "Charging-only when locked, except before first unlock" or "On"</li><li>use default desktop mode configuration since our changes are no longer needed to enable features and caused crashes for at least 1 user which were addressed with an out-of-band release prior to this one</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): add back recent dma-buf changes now that an upstream use-after-free bug is resolved</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.118</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.146.0">version 143.0.7499.146.0</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121701 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121200">2025121200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121200">2025121200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121000 release:</p><ul><li>disable notification summaries and organizer features due to AOSP and GrapheneOS lacking the AI models used to implement these features</li><li>add workaround for notification background appearance regression in Android 16 QPR2</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.109.0">version 143.0.7499.109.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-167">version 167</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121201 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121000">2025121000</a></h3><p>This is our first non-experimental release based on Android 16 QPR2 after our initial experimental 2025120800 release.</p><p>The change to the style of notification backgrounds is an upstream regression rather than an intentional change to a more minimal style. It will be fixed in a subsequent release since we decided it isn't important enough to delay this.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121000">2025121000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025120400 release:</p><ul><li>full 2025-12-05 security patch level</li><li>rebased onto BP4A.251205.006 Android Open Source Project release (Android 16 QPR2)</li><li>disable promotion of identity check feature not currently present in GrapheneOS due to depending on privileged Google Mobile Services integration</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-166">version 166</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121001 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025120400">2025120400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025120400">2025120400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025112100 release:</p><ul><li>full 2025-12-01 security patch level (has already been fully provided by our security preview releases for at least a month and most of the patches since September)</li><li>add experimental support for the Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold (there were 2 standalone experimental releases prior to this via 2025112500 and 2025113000 along with corresponding security preview releases for each)</li><li>Cell Broadcast Receiver: switch back to our modified text for the presidential alerts toggle</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.158</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.116</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.60</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/90">version 90</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.0">version 143.0.7499.34.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.1">version 143.0.7499.34.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.2">version 143.0.7499.34.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.52.0">version 143.0.7499.52.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-164">version 164</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-165">version 165</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025120401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0006</li><li>High: CVE-2025-26447, CVE-2025-32348, CVE-2025-48578, CVE-2025-48579, CVE-2025-48582, CVE-2025-48585, CVE-2025-48587, CVE-2025-48609, CVE-2025-48622, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008, CVE-2026-0009, CVE-2026-0010</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025112100">2025112100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025112100">2025112100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025111800 release:</p><ul><li>fix regression from our Android 16 QPR1 port causing enabling the Network permission to not work without a reboot</li><li>adevtool: fix SELinux policy handling issue causing fingerprint registration issues on the devices with power button fingerprint readers (Pixel Tablet, Pixel Fold, Pixel 9 Pro Fold) with Android QPR1</li><li>fix port of our notification forwarding between user profiles feature to Android 16 QPR1</li><li>enable new UI customization picker UI from Android 16 QPR1</li><li>Wallpaper Picker: don't use the CuratedPhotos categories which aren't setup in AOSP</li><li>Wallpaper Picker: hide the always-empty wallpaper carousel</li><li>Wallpaper Picker: enable integration of the embedded photo picker</li><li>System Updater, Sandboxed Google Play compatibility layer: switch to Material 3 Expressive theme for Settings app menus</li><li>Cell Broadcast Receiver: fix presidential alerts toggle added by GrapheneOS not being enabled without the main emergency alerts toggle being toggled off and on</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.171.0">version 142.0.7444.171.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025112101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025111800">2025111800</a></h3><p>Following our experimental releases, this is our first non-experimental release based on Android 16 QPR1, the first quarterly release of Android 16. Android 16 QPR1 was pushed to the Android Open Source Project on November 11 rather than September 3 as expected. This is a very large quarterly release with more prominent user-facing improvements than Android 16 provided compared to Android 15 QPR2.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025111800">2025111800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025110800 release:</p><ul><li>rebased onto BP3A.250905.014 Android Open Source Project release (Android 16 QPR1)</li><li>Terminal (virtual machine management app): re-enable GUI support now that the surfaceflinger crashes are resolved upstream by Android 16 QPR1</li><li>adevtool: massive overhaul entirely replacing the small remnants of the Pixel device trees to fix several regressions introduced since Android 16 such as charging mode booting into the regular OS and to prepare for adding 10th gen Pixel devices via automated device support without any need for device trees to use as a reference</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>raise declared patch level to 2025-11-05 which has already been provided in GrapheneOS since our regular <a href="https://grapheneos.org/releases#2025090200">2025090200</a> release (not a security preview) since the patches were included in the September security preview and were then pushed to AOSP despite not being listed in the bulletin along with there being no Pixel Update Bulletin patches for November 2025</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.158.0">version 142.0.7444.158.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025111801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>The official Android security preview patches are for the initial release of Android 16 and we had to port the patches to Android 16 QPR1. This resulted in it taking significantly longer to be available. Due to this, 2025111801 also bundles Vanadium 142.0.7444.171.0 which was released through our App Store after the regular OS release but prior to the security preview OS release. It's otherwise a normal security preview release with no non-security-preview patch related changes beyond the Vanadium release being included.</p><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025110800">2025110800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025110800">2025110800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025110600 release:</p><ul><li>adevtool: fully automate handling SoC and radio firmware image backports, which resolves an issue with a version string mismatch in the previous release for the initial installation process which resulted in us cancelling the Stable channel release</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.138.1">version 142.0.7444.138.1</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025110600">2025110600</a></h3><p>Both of the November 2025 patches have been provided in our regular non-security-preview releases for over a month, so we've already had the 2025-11-05 Android security patch level for over a month. Our patch level is set based on providing both the Android and Pixel security patches, so we're leaving it at 2025-11-01 until the Pixel stock OS release and Pixel Update Bulletin are published. The stock Pixel OS also included both November 2025 patches in early September. We expect they made a 2nd October release to ship the November carrier changes and will make a release in mid-November with patches from future Android Security Bulletins.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025110600">2025110600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102800 release:</p><ul><li>raise declared patch level to 2025-11-01 which has already been provided in GrapheneOS since our regular <a href="https://grapheneos.org/releases#2025090200">2025090200</a> release (not a security preview) since the patches were included in the September security preview and were then pushed to AOSP despite not being listed in the bulletin</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): keep POSIX_MQUEUE disabled to avoid increasing attack surface</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.114</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>adevtool: switch to obtaining Android 16 QPR1 backports from the latest November releases for relevant Pixels (there are no security patches listed for the Android or Pixel bulletins and not all Pixels received the tiny release)</li><li>Settings: add 1 second delay for approving device admin activation to mitigate tapjacking (this matches the 1 second delay we add to both permission prompts and ADB authorization prompts which is currently not configurable)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.138.0">version 142.0.7444.138.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102800">2025102800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102800">2025102800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102600 release:</p><ul><li>Sandboxed Google Play compatibility layer: temporarily limit system service override infrastructure added for GmsFontProvider shim to Pixel Camera to work around certain banking apps detecting it as tampering (we can change the approach to avoid this to enable it for all apps using the Google Play client libraries again, especially since we want to expand it to improve app compatibility without Play services installed)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.112</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.53</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102600">2025102600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102600">2025102600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102300 release:</p><ul><li>Sandboxed Google Play compatibility layer: add shim implementation of GmsFontProvider to prevent crashes of apps depending on Play services when it's missing or disabled (restores support for using Pixel Camera without Play services)</li><li>Sandboxed Google Play compatibility layer: extend shim for background service starts to address edge cases where a foreground service is required</li><li>Sandboxed Google Play compatibility layer: fix NoOpPrewarmService chain crash in Pixel Camera caused by lack of privileged OS integration</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.48.0">version 142.0.7444.48.0</a></li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102300">2025102300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102300">2025102300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102200 release:</p><ul><li>fix signing the GmsCompatLib package with a dedicated cross-device key, which was added in the last release but wasn't being replaced by a release key and blocked moving the last release past Alpha</li><li>kernel (6.12): update to latest GKI LTS branch revision</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102200">2025102200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102200">2025102200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025100900 release:</p><ul><li>adevtool: add satellite eSIM overlays to avoid the special Skylo eSIM on 9th/10th gen Pixels being listed as a regular eSIM and being possible to erase with the regular eSIM erase functionality</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.111</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.52</li><li>System Updater: prevent reboot and security preview notifications from timing out after 3 days which is standard behavior since Android 15 QPR1</li><li>System Updater: mark notification permission as fixed to prevent disabling overall notifications but exclude the channels for progress, errors and already up to date notifications from it so that only reboot and security preview notifications are mandatory</li><li>Sandboxed Google Play compatibility layer: add support for overriding BinderProxy transactions</li><li>Sandboxed Google Play compatibility layer: add support for out-of-band updates to GmsCompatLib</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.111.0">version 141.0.7390.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.122.0">version 141.0.7390.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-163">version 163</a></li><li>raise emulator super / dynamic partition size due to reaching the limit in some cases</li><li>adevtool: prefer prebuilt AOSP JDK 21</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025100900">2025100900</a></h3><p>One of the changes in this release should result in Google Messages RCS working for users receiving a verification error caused by Play Store checking for an emulator with an easy to bypass check. It was already working for many users without this but this should get it working for everyone else.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025100900">2025100900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025100300 release:</p><ul><li>raise security patch level to 2025-10-05 since it's already provided without applying any additional patches</li><li>System Updater, Setup Wizard: integrate support for recommending opting into security preview releases during the initial Owner user setup and for existing users via a persistent notification which is disabled after making an explicit choice on whether to use security preview releases (this is necessary to inform all users about the option with an explicit choice)</li><li>Settings: add support for forcing VoWiFi availability</li><li>Settings: improve the carrier configuration override by improving the summaries, adding detailed descriptions and using clarifying the options force features to be available since there are also toggles for directly enabling/disabling the features in the main SIM settings screen</li><li>Sandboxed Google Play compatibility layer: fix a Google Messages RCS compatibility issue by removing the error string for the missing privileged permission from SurfaceFlinger::doDump() to make a DroidGuard check pass</li><li>Sandboxed Google Play compatibility layer: make Play Store ignore app auto-install config</li><li>Sandboxed Google Play compatibility layer: fix Build.getSerial() shim to fix an Android Auto issue</li><li>Sandboxed Google Play compatibility layer: add stub for TelephonyManager.getImei()</li><li>Sandboxed Google Play compatibility layer: add stub for Window.setHideOverlayWindows() to replace reliance on a feature flag override via GmsCompatConfig</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.155</li><li>update test suite to handle our carrier overrides support</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.70.0">version 141.0.7390.70.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/90">version 90</a></li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025100901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025100300">2025100300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025100300">2025100300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025092700 release:</p><ul><li>add support for force enabling VoLTE, VoNR and 5G for carriers where those aren't supported with the standard configurations</li><li>revert backport of Pixel Wi-Fi extension APEX from Android 16 QPR1 due to it causing a system_server crash since it needs changes there too (this does not reduce the patch level)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.154</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.108</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.49</li><li>update SQLite to 3.44.5 LTS release</li><li>Network Location, System Updater: add new Let's Encrypt roots to TLS key pinning configuration</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-162">version 162</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/89">version 89</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025100301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>CVE-2025-48595 was fixed in the regular GrapheneOS 2025100300 release and is no longer listed.</p><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025092700">2025092700</a></h3><p>This release adds official support for using RCS in Google Messages. Using this requires granting the Phone permission to Play services to provide carrier information to it, granting the required permissions to Google Messages and then setting Google Messages as the current carrier messaging app. Setting an app as the carrier messaging app provides it with device identifier access which is documented in our FAQ. However, Google Messages is a special case where part of the implementation is in Play services. We've dealt with this by special casing the device identifier permission check to detect when the user has granted this access to the official Google Messages app which then also provides the official Play services app with the same access. This doesn't provide any extra access in practice since Google Messages shares the information with Play services.</p><p>Re-enabling RCS after disabling it isn't expected to work yet and you'll need to clear the app data to enable it.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025092700">2025092700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025092500 release:</p><ul><li>add SystemUI and Settings integration for detecting and notifying Pixel 6a users with batteries impacted by the fire hazard issue resulting in capacity and charging being throttled along with directing users to the support options for getting a free battery replacement, $150 credit or $100 cash as compensation for the faulty battery (a subset of this will be replaced by AOSP code when Android 16 QPR1 is finally pushed to AOSP)</li><li>Sandboxed Google Play compatibility layer: add request for the unprivileged <code>READ_PHONE_NUMBERS</code> permission to Play services which users can manually grant via the Phone permission since it's needed for RCS activation but is not requested since they request the privileged permission instead</li><li>Sandboxed Google Play compatibility layer: when users have granted device identifier access to the official Google Messages app by setting it as the default SMS/MMS/RCS app</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.43.0">version 141.0.7390.43.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.43.1">version 141.0.7390.43.1</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025092701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48595, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025092500">2025092500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025092500">2025092500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025091900 release:</p><ul><li>System Updater: add support for opting into security preview releases</li><li>backport more cellular related code from Android 16 QPR1</li><li>backport Pixel Wi-Fi extension APEX from Android 16 QPR1</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.207.0">version 140.0.7339.207.0</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025092501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48595, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025091900">2025091900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025091900">2025091900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025091000 release:</p><ul><li>backport latest carrier and cellular radio configurations from Android 16 QPR1</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.152</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.104</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.47</li><li>kernel (6.6): prepare for usage on bare metal arm64 devices by setting up arm64 emulator builds (Pixel 10 uses 6.6 and earlier Pixels will likely move to it soon)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.155.0">version 140.0.7339.155.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025091000">2025091000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025091000">2025091000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090800 release:</p><ul><li>full 2025-10-01 security patch level</li><li>partially backport Android 16 QPR1 Pixel userspace device support: RIL, eSIM, TPU and NeuralNetworks (deprecated)</li><li>kernel (6.1): roll back recent upstream Android GKI dma-buf changes due to a few MTE crash reports</li><li>kernel (6.1, 6.6, 6.12): disable unused memory hotplug support</li><li>kernel (6.1, 6.6, 6.12): fix linear region randomization by dropping memory hotplug support (see <a href="https://project-zero.issues.chromium.org/issues/434208461">the Project Zero issue</a> where the upstream Linux maintainers decided not to fix the issue)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.45</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.123.0">version 140.0.7339.123.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090800">2025090800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090800">2025090800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090600 release:</p><ul><li>backport the rest of the Android 16 QPR1 Pixel firmware (Bluetooth, Wi-Fi, GNSS, UWB, NFC, secure element, GPU, AOC, TPU and GXP)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090600">2025090600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090600">2025090600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090500 release:</p><ul><li>Pixel Tablet: fix regression for install zips in the previous release causing a version check for non-existent cellular baseband firmware to fail when doing the initial installation</li><li>add back Git commit metadata for the kernel image and modules by setting an environment variable to use the repo metadata from the Pixel kernel tarballs</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090500">2025090500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090500">2025090500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090300 release:</p><ul><li>move to new monolithic Pixel kernel repository setup with a single repository for Pixels and our portable Generic Kernel Image repository as a submodule to more easily handle Pixel kernel sources being released as tarballs instead of Git tags (Git metadata for the kernel image and modules will be added back in the next release)</li><li>update to Android 16 QPR1 kernel drivers and kernel build system to ship the security patches prior to Android 16 QPR1 being released to AOSP</li><li>update Pixel SoC and cellular radio firmware to the Android 16 QPR1 releases to ship the security patches prior to Android 16 QPR1 being released to AOSP</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/32">version 32</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/33">version 33</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.51.0">version 140.0.7339.51.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090300">2025090300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090300">2025090300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090200 release:</p><ul><li>Sandboxed Google Play compatibility layer: add stub for Debug.dumpService("media_projection") to fix a recent regression caused by a Google Play Store behavior change yesterday which was breaking using the Play Integrity API and therefore slightly reducing app compatibility</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090200">2025090200</a></h3><p>This is an early September security update release based on the September 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090200">2025090200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025081400 release:</p><ul><li>full 2025-09-01 security patch level</li><li>add support for address lines in the GrapheneOS geocoder implementation</li><li>Dialer: fix visual voicemail with Verizon MVNOs by working around AOSP Dialer not supporting vvm_type_vvm3_mvno</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.148</li><li>kernel (6.1): reapply minor f2fs change we previously reverted due to it causing a regression since the stock Pixel OS has shipped it a while ago so the regression must have been fixed by other changes</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.102</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.42</li><li>adevtool: massive overhaul to improve our infrastructure for device support</li><li>adevtool: add command for extracting aconfig flag values from device images</li><li>adevtool: add command for decompiling APKs and JARs from device images and creating an IntelliJ project from it</li><li>adevtool: detect missing vendor regeneration after adevtool changes</li><li>adevtool: parallelize state regeneration and remove unnecessary data from serialized build state files</li><li>Theme Picker: use AOSP launcher name for fetching resources in preparation for Android 16 QPR1 requiring this to be set up properly</li><li>Settings: prepare PIN scrambling setting for the upcoming port to Android 16 QPR1</li><li>Seedvault: update to 16-5.7 (there are no changes to the code compared to the Android 16 development revision we previously shipped, only translation changes)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-161">version 161</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.158.0">version 139.0.7258.158.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.35.0">version 140.0.7339.35.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/87">version 87</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/88">version 88</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/31">version 31</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/31">version 31</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025081400">2025081400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025081400">2025081400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025081300 release:</p><ul><li>temporarily revert extended fix for upstream MediaMetadata bug due to it causing a regression and needing to be adjusted</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/86">version 86</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025081300">2025081300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025081300">2025081300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025080600 release:</p><ul><li>limit MediaMetadata object size to avoid Binder failures to resolve the rest of an upstream Android denial of service issue triggered in real world use by LibreTube (this extends our previous fix in our <a href="https://grapheneos.org/releases#2025072700">2025072700</a> release)</li><li>reduce time update threshold to 50ms from Android's default 2000ms instead of allowing the clock to get up to 2s out-of-date (this change was lost during one of the major release ports when Android significantly changed the code and moved where this is configured)</li><li>Pixel 8a: fix inclusion of PSDS overlay since our port to Android 16 which was breaking using our PSDS proxy until we worked around it server-side with a redirect from broadcom.psds.grapheneos.org to samsung.psds.grapheneos.org for the Samsung PSDS download path</li><li>Samsung GNSS devices (Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a): switch to TLSv1.3-only for SUPL instead of TLSv1.2-only now that it's supported by gnssd</li><li>change User-Agent for geocoder to "GrapheneOS geocoder $USER_AGENT_VERSION" where the version is currently 1 and can be incremented if there are significant changes to how we make requests (this was previously using the default Android User-Agent sending more information than necessary)</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.101</li><li>Seedvault: update to latest revision for Android 16 (will be replaced with a better backup implementation in the future)</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/84">version 84</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/85">version 85</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/6">version 6</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.123.0">version 139.0.7258.123.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025080600">2025080600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025080600">2025080600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025080400 release:</p><ul><li>full 2025-08-05 security patch level</li><li>apply the only change not related to the Pixel 6a battery workaround from the August 2025 Pixel kernel drivers obtained via GPL source request</li><li>update to August 2025 Pixel vendor/firmware code</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/12">version 12</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025080400">2025080400</a></h3><p>This is an early August security update release based on the August 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Android Security Bulletin tags have not yet been pushed to the Android Open Source Project this month but we've had access to the signed partner bulletin zip with the same patches for a month. There are only 3 patches in the August 2025-08-01 bulletin and one of those doesn't impact Android 16. Of the 2 marked as impacting Android 16, the critical severity issue was already fixed in the initial Android 16 release. Therefore, there's only a single High severity patch to Android 16 for the Android Open Source Project for August.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025080400">2025080400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025073000 release:</p><ul><li>full 2025-08-01 security patch level</li><li>add opt-in service for geocoding (translating location names to coordinates) and reverse geocoding (translating coordinations to location names) with the option of either a GrapheneOS proxy to Nomanatim or direct use of Nominatim which will improve compatibility with a tiny subset of apps depending on the OS providing this without an alternative (the service is open source with open data so our proxy is temporary and will be replaced with a self-hosted service, but we need to determine if we want to use Nominatim or Photon along with dealing with the high hardware requirements far beyond what our current network servers can provide)</li><li>add a workaround for bug in sonycast.sdk.ScMediaRouteProvider used by Tidal and other apps causing occasional NsdService related crashes in combination with VPN lockdown due to us fixing NsdService related VPN leaks</li><li>override pseudo locales with their respective base locales in the Android Runtime since they're currently broken and break using the device (we already disabled enabling pseudo locales in the previous release but a couple users enabled this developer option and need a release fixing it to use their device)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.147</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.100</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.62.0">version 139.0.7258.62.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.62.1">version 139.0.7258.62.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025073000">2025073000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025073000">2025073000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025072800 release:</p><ul><li>extend our workaround for the upstream Android asynchronous dexopt optimization issue to handle original-package package renaming which we used to rename Vanadium's package name from org.chromium.chrome to app.vanadium.browser years ago and users on 6th gen Pixels with installs prior to it could have a crash caused by our fix for the upstream issue</li><li>add a temporary workaround for AOSP Dialer still using a legacy approach to notifications which interacts badly with notification grouping</li><li>remove support for switching to a pseudo-locale when developer options are enabled since it can cause major issues</li><li>Sandboxed Google Play compatibility layer: add stub for BluetoothDevice.getBondState() to avoid Android Auto crash</li><li>Settings: fix upstream Android null pointer exception in UserAspectRatioDetails.launchApplication()</li><li>System Updater: update minimum and target API level to 36 (Android 16)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025072800">2025072800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025072800">2025072800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025072700 release:</p><ul><li>add missing multi-user handling to the package information query used by both of the new VPN leak protections which was discovered during Alpha channel testing from app crashes in secondary users for apps not installed in the Owner user</li><li>fix implementation of INsdServiceConnector stub used as part of our NsdService#connect VPN leak protection to avoid an edge case resulting in app crashes found during Alpha channel testing</li><li>include additional overlays from the stock Pixel OS for Settings animations and Settings/SystemUI strings mostly related to documentation</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025072700">2025072700</a></h3><p>This release resolves 2 upstream Android VPN leaks discovered by GrapheneOS and our community testers. We aren't aware of any other outbound Android VPN leaks when Private DNS is set to Off. Android's Private DNS feature needs a significant overhaul for how it works with secondary profiles and VPNs.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025072700">2025072700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025071900 release:</p><ul><li>prevent using SO_BINDTODEVICE to bypass VPN lockdown mode (leak protection) to resolve an upstream Android VPN leak discovered by GrapheneOS testers where code specifies a specific interface via a special system call to bypass the VPN</li><li>prevent using NsdService#connect for components restricted by VPN lockdown mode to prevent a very limited upstream Android local network VPN leak discovered by GrapheneOS</li><li>add workaround for upstream Android asynchronous dexopt bug causing concurrent installs of the same package to be handled incorrectly which then causes crashes when attempting to uninstall</li><li>temporarily disable asynchronous pre-reboot OS update app optimization (dexopt) added in Android 16 to avoid the Finalizing step completing before apps are recompiled which can then result in it causing a very long initial boot of the new OS version if the user reboots before the background app optimization completes (this will not apply to updating to this release but rather only updating to future releases from this one and onwards)</li><li>MediaMetadata: fix upstream Android bug by using shared bitmaps to avoid serialized metadata going beyond the Binder transaction size limit and causing system service failures including Bluetooth service crashes (this issue existed prior to Android 16)</li><li>Sandboxed Google Play compatibility layer: revert change for dropping phenotype flag overrides before applying new ones since it can cause flag values to be set inconsistently due to a race</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.146</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.99</li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/4">version 4</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-160">version 160</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.168.0">version 138.0.7204.168.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.168.1">version 138.0.7204.168.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025071900">2025071900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025071900">2025071900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070800 release:</p><ul><li>Dialer: always show scrollbar for button grid when there are more than 6 buttons to make it clear it can be scrolled</li><li>Dialer: move RTT button to the end since it's rarely used</li><li>Network Location: improve position estimation implementation to provide better performance, accuracy and stability</li><li>Network Location: add support for detecting location based on cell towers when Wi-Fi-based location can't obtain any position estimate</li><li>add back "Prevent ringing" gesture via Power + Volume Up which was lost in the port to Android 16</li><li>Settings: fix discharge time estimates not being shown when charging optimization (charging limit) enabled</li><li>Settings: avoid explanation in per-app Play Integrity API settings being cut off</li><li>fully prevent empty end session button being shown</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.145</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.98</li><li>include more color overlays from the stock Pixel OS</li><li>add back desktop mode toggle to developer options which was missing due to Android 16 requiring enabling config_isDesktopModeDevOptionSupported in addition to the config_isDesktopModeSupported feature we were already enabling</li><li>adevtool: add infrastructure for defining synthetic overlays and migrate to using it (automates more of device support and results in the battery charging limit text being updated)</li><li>adevtool: heavily optimize state collection by only calculating what gets built instead of building it</li><li>enable optimization of pausing wallpaper rendering for Pixel Camera</li><li>Terminal (virtual machine management app): temporarily disable GUI support until Android 16 regression causing surfaceflinger crash is resolved</li><li>Seedvault: update to 15-5.6 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.157.0">version 138.0.7204.157.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-159">version 159</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070800">2025070800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070800">2025070800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070700 release:</p><ul><li>update to BP2A.250705.008 vendor files (July 2025 Pixel monthly release)</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed since releasing our port to Android 16 (users can enable this themselves via Settings &gt; Security and privacy &gt; More security and privacy &gt; Notify about system process crashes)</li><li>NFC: always show standard confirmation dialog before opening a URL instead of it only being enabled for a small subset of users</li><li>temporarily remove NFC auto-turn-off feature since it can cause NFC HAL or system_server crashes in rare edge cases and we need to entirely reimplement it inside of the NFC APEX module to avoid the problems (there were rare issues reported prior to Android 16 but 1 user reported an NFC HAL crash loop on Android 16 making it clear we need to drop this until we redo it in a better way)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070700">2025070700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070700">2025070700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070600 release:</p><ul><li>raise security patch level to 2025-07-05 since it's already provided without applying any additional patches</li><li>only permit third party apps to use custom activity animations for transitions between their own activities to prevent a recently disclosed <a href="https://taptrap.click/">Android tapjacking vulnerability branded as TapTrap</a></li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: fix regression breaking DisplayPort alternate mode in the previous release</li><li>Sandboxed Google Play compatibility layer: fix phenotype flag overrides not working on production builds which regressed quite a while ago and limited our ability to fix certain compatibility issues via quick GmsCompatConfig updates</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070600">2025070600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070600">2025070600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070500 release:</p><ul><li>backport fix for back button regression in Android 16 from Android 16 QPR1 Beta 2.1</li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: restore using asymmetric MTE mode for userspace instead of the default asynchronous mode</li><li>add back switching to using the Natural display color mode by default</li><li>migrate more device support to adevtool and remove more unused configuration</li><li>improve per-device integration for USB-C port control and pogo pins control to make maintenance easier</li><li>adevtool: remove obsolete overlay handling implementation</li><li>remove Circle to Search feature declaration</li><li>enable Runtime Resource Overlay (RRO) enforcement</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070500">2025070500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070500">2025070500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070301 release:</p><ul><li>partially revert upstream changes in Android 16 breaking parts of the lockscreen layout including the date and media info</li><li>Pixel 8 Pro, Pixel 9 Pro, Pixel 9 Pro XL: add back feature declaration for Pixel Thermometer support lost in our Android 16 device port migration which prevented fresh installs of the app</li><li>Terminal (virtual machine management app): disable VM console feature since it isn't supported by the stable release of Android 16 outside of debug builds and trying to use it breaks installing the new images (the feature can be enabled once the core OS supports it in production builds)</li><li>update Pixel HAL compatibility matrix version numbers for Android 16</li><li>add lockscreen synchronization failsafe to protect against unknown vulnerabilities</li><li>improve code quality and add unit tests for our strict CVE-2024-50089 protection</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.94</li><li>fix port of our 2-factor fingerprint authentication tests to Android 16</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070301">2025070301</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070301">2025070301</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070300 release:</p><ul><li>fix upstream Android 16 issue causing very large Binder transactions due to the size scaling based on the number of apps installed across all users including base OS apps</li><li>reduce virtual memory reserved for Binder buffers back to 1MiB now that we have a direct fix for the upstream issue causing more to be required and using a larger virtual memory reservation size appears to have a small chance of failing</li><li>revert our fix for a screenshot process crash that's now fixed upstream in Android 16</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070300">2025070300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070300">2025070300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070100 release:</p><ul><li>increase virtual memory reserved for Binder buffers from 1MiB to 8MiB due to Android 16 having a very large Binder transaction scaling up based on the number of apps and profiles which can go beyond the total size limit and break fully booting the OS, which occurred for a tiny number of our Alpha testers (if you were one of the tiny number of Alpha channel testers running into this, you can <a href="https://grapheneos.org/updates#sideloading">sideload this release</a> to resolve the issue)</li><li>fix issues with display of the end session button to avoid it being wrongly displayed for Owner or not displayed for secondary users (we may remove this part of the upstream end session UI or make it optional since the functionality is also in the power menu)</li><li>update Pixel USB HAL to Android 16 (this was omitted in the initial port due to needing special handling for our USB-C port and pogo pins control feature)</li><li>always use UTC as the time zone for build date properties</li><li>kernel (6.6): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070100">2025070100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070100">2025070100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025063000 release:</p><ul><li>Exynos 5400 modem Pixels (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): temporarily disable hardened_malloc and hardware memory tagging for shared_modem_platform executable due to an upstream write-after-free bug</li><li>Launcher: fix upstream bug causing a crash for the interface to add lockscreen widgets (currently a tablet only feature until Android 16 QPR1)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.63.0">version 138.0.7204.63.0</a></li><li>add debug build functionality for toggling off hardened_malloc usage for vendor processes to make narrowing down issues quicker</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025063000">2025063000</a></h3><p>This is the initial official release of GrapheneOS based on Android 16 after the June 10th release of Android 16. Device support for Pixels was removed from the Android Open Source Project for Android 16 and had to be reimplemented which is why it took so much longer than usual. Please join our <a href="https://grapheneos.org/contact#community-chat">testing chat room</a> if you're interesting in testing this experimental release. We'll be making a series of releases this week to fix several known issues and other issues.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025063000">2025063000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025062700 release:</p><ul><li>full Android 16 port with all GrapheneOS features available (we previously shipped some parts of Android 16 backported to Android 15 QPR2 to provide the 2025-06-05 and then 2025-07-01 Pixel patch level)</li><li>migrate to using adevtool to handle a much larger portion of device support since the Android Open Source Project no longer includes device support for Pixels</li><li>adevtool: add new arcslib infrastructure for extracting resource overlays from the stock Pixel OS</li><li>adevtool: use fixed build number and build date for state regeneration to reduce diffs</li><li>don't disable external ports at boot on debug builds for internal development for debugging early boot failures</li><li>temporarily enable system crash notifications unconditionally for early Android 16 testing</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025062700">2025062700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025062700">2025062700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025062000 release:</p><ul><li>raise security patch level to 2025-07-01 since it's already provided without applying any additional patches</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Pixel 6, Pixel 6 Pro, Pixel 6a: remove AOSP configuration marking android.hardware.location.network as unavailable since it has meant to be declared available since our <a href="https://grapheneos.org/releases#2023062300">2023062300 release</a> adding emulated network location and we also have our own opt-in network location implementation since our <a href="https://grapheneos.org/releases#2025022700">2025022700 release</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.35.0">version 138.0.7204.35.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.0">version 138.0.7204.45.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.1">version 138.0.7204.45.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.2">version 138.0.7204.45.2</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025062000">2025062000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025062000">2025062000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061900 release:</p><ul><li>fix an issue with our added infrastructure for overriding the minimum SDK version for APK-based components backported from Android 16 (Samsung Shannon IMS/RCS was not active resulting in VoLTE, VoNR, VoWi-Fi, SMS via LTE/NR/Wi-Fi and RCS not working so the 2025061900 release was quickly cancelled before being rolled out to a large number of Alpha channel users)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061900">2025061900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061900">2025061900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061600 release:</p><ul><li>full 2025-06-05 Pixel security patch level based on Android 16 backports (full Android 2025-06-05 patch level was provided in an earlier release)</li><li>Pixels: backport Android 16 Wi-Fi firmware, Bluetooth firmware and TPU firmware</li><li>Pixels: backport Android 16 Samsung Radio Interface Layer (RIL) code</li><li>Sandboxed Google Play compatibility layer: fix rare system_server crash reported with Android Auto by adding check for a null calling package</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.115.0">version 137.0.7151.115.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061600">2025061600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061600">2025061600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061500 release:</p><ul><li>partial 2025-06-05 security patch level (Android 2025-06-05 patch level is provided but still only a subset of the Pixel 2025-06-05 patch level due to remaining Android 16 firmware/driver patches being required)</li><li>update to Android 16 kernel drivers and kernel build system to ship the Pixel kernel driver patches from Android 16 while we're still reimplementing device support for Pixels due to AOSP removing it</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061500">2025061500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061500">2025061500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061300 release:</p><ul><li>adjust our hard-wired Android 16 cellular radio version string to pass the case sensitive check done by the install process</li><li>adjust the SUPL disabled mode to work around Samsung gnssd (Pixel 8a and all 9th gen Pixels) not implementing SUPL_MODE properly (reboot is required for the Off mode to kick in on these devices)</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/11">version 11</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061300">2025061300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061300">2025061300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061000 release:</p><ul><li>update SoC and cellular radio firmware to the Android 16 releases to ship the security patches prior to our Android 16 port</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.89.0">version 137.0.7151.89.0</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/10">version 10</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061000">2025061000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061000">2025061000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025060200 release:</p><ul><li>expand our code for checking Google Play Store source stamp signatures to checking each split APK in order to prepare it for future security-relevant usage including optionally marking apps as installed from the Play Store after verifying the source stamp (this is currently used for stripping Play Store inserted checks for apps being installed from the Play Store which had looser security requirements)</li><li>remove Chunghwa Telecom and Netlock Certificate Authorities (CAs) based on <a href="https://security.googleblog.com/2025/05/sustaining-digital-certificate-security-chrome-root-store-changes.html">the decision by the Chrome Root Store</a> (this does not impact Vanadium since it uses a more sophisticated browser root store rather than the OS root store and will distrust certificates from these CAs not added to Certificate Transparency logs before 2025-08-01 to avoid website compatibility issues)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.141</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.72.0">version 137.0.7151.72.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.72.1">version 137.0.7151.72.1</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/9">version 9</a></li><li>Network Location: increase difficulty of position estimation tests to help avoid regressions</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025060200">2025060200</a></h3><p>This is an early June security update release based on the June 2025 security patch backports since the yearly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025060200">2025060200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025060100 release:</p><ul><li>full 2025-06-01 security patch level</li><li>System Updater: temporarily revert notification protection due to upstream Android UI issues for this feature with privileged apps (we still plan to do this but it will need to wait until we resolve the OS issue)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025060100">2025060100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025060100">2025060100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025052800 release:</p><ul><li>Media Provider: expand our existing protection against CVE-2024-50089 which is still not addressed upstream (we added generic hardening in 2022 as a prerequisite for Storage Scopes which along with fixing information leaks still unfixed upstream blocked exploiting CVE-2024-50089 for the common cases of not granting permissions, granting media permissions or using our Storage Scopes feature but we didn't fully cover "All files access" or the legacy API level equivalent when not using Storage Scopes)</li><li>System Updater: prevent disabling overall notifications due to lack of a use case and many users doing it by accident, but continue allowing disabling the individual notification channels other than the reboot notification</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.92</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/8">version 8</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.61.0">version 137.0.7151.61.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025052800">2025052800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025052800">2025052800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025052000 release:</p><ul><li>disable anti-competitive code being injected by the Play Store into apps choosing to enable "App integrity &gt; Automatic protection" when there's a valid Play Store source stamp signature (proving that it's an unmodified app from the Play Store, so we aren't disabling an integrity check) since it prevents using the apps on GrapheneOS when apps also choose to enable "App integrity &gt; Store listing visibility" with either the "Device integrity checks" or "Strong integrity checks" values enforcing having a device licensing Google Mobile Services and running the stock OS (circumventing this is protected by the DMCA exemption for jailbreaking)</li><li>Private Space: fix further issues with quiet/locking state changes in secondary users</li><li>extend NFC auto-turn-off to work when logged into a secondary user</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.140</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.44.0">version 137.0.7151.44.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.44.1">version 137.0.7151.44.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025052000">2025052000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025052000">2025052000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025051900 release:</p><ul><li>Private Space: set correct state on user start or stop for secondary users</li><li>Private Space: make sure nested profiles in secondary users have their storage put at rest when the parent profile's session is ended</li><li>Keyboard: remove dedicated language switch key from the phone layout since it's already shown by the OS itself and uses up too much space with the emoji key already next to the space bar</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025051900">2025051900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025051900">2025051900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050700 release:</p><ul><li>add NFC auto-turn-off setting to go along with the existing addition of Wi-Fi and Bluetooth auto-turn-off settings</li><li>Private Space: add new setting for disabling delayed locking of storage to make locking work like secondary user end session feature we enable, similar to the toggle we add for disabling secondary users running in the background (standard Private Space doesn't work this way to keep fingerprint unlock available after it's locked/stopped)</li><li>Private Space: add new setting for blocking sharing the clipboard to and/or from the parent profile and other nested profiles within it</li><li>Private Space: add support for the Install available apps feature we currently enable to support installing apps available in the Owner user to secondary users</li><li>Private Space: add support for secondary users including all standard features with the exception of auto-locking support since our implementation of that is too complex/invasive to properly review and test while we're focused on Android 16 porting</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.138</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.89</li><li>Keyboard: move the emoji key to the left of the space bar for the phone layout instead of putting it behind a long press or replacing the enter key with it when put into the emoji mode by apps like AOSP Messaging</li><li>Keyboard: stop replacing the emoji key with the .com key for the email and URL input types</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.125.0">version 136.0.7103.125.0</a></li><li>add support for testing Android 16 Beta 4.1 feature flags for development builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050700">2025050700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050700">2025050700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050500 release:</p><ul><li>full 2025-05-05 security patch level</li><li>rebased onto BP1A.250505.005.D1 Android Open Source Project release</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.87.0">version 136.0.7103.87.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050500">2025050500</a></h3><p>This is an early May security update release based on the May 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050500">2025050500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050300 release:</p><ul><li>full 2025-05-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050300">2025050300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050300">2025050300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025042500 release:</p><ul><li>extend security state manager service to support the official Auditor release (based on the signing key) obtaining additional security state (currently the configuration for auto-reboot, USB-C port and pogo pins control, OEM unlocking and user count)</li><li>Auditor: add default enabled data saver exemption</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to synchronous mode for the Hardware Tag-Based KASAN implementation to improve security and error reporting (we'll continue using asymmetric mode in userspace where it provides very comparable security and error reporting to synchronous mode with lower overhead)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): revert upstream Linux kernel change attempting to work around frame drops caused by a workaround used by video players on X11-based platforms (irrelevant to Android) due to it breaking DisplayPort alternate mode audio</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.88</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/89">version 89</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/29">version 29</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/30">version 30</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.60.0">version 136.0.7103.60.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-157">version 157</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-158">version 158</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025042500">2025042500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025042500">2025042500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025041100 release:</p><ul><li>Bluetooth: backport upstream fixes for compatibility with certain Bluetooth peripherals caused by a recent security fix for Bluetooth encryption</li><li>avoid granting special runtime permissions (Network, Sensors) added by GrapheneOS when unarchiving an app</li><li>use our restricted setting infrastructure to restrict system app access to our notification forwarding setting too</li><li>Settings: prevent disabling system Dialer app since it's always required for emergency calls</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.134</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.87</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.100.0">version 135.0.7049.100.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.111.0">version 135.0.7049.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.44.0">version 136.0.7103.44.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025041100">2025041100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025041100">2025041100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025040700 release:</p><ul><li>full 2025-04-05 security patch level</li><li>rebased onto BP1A.250405.007.D1 Android Open Source Project release</li><li>remove code for Qualcomm XTRA (PSDS) privacy improvements since we no longer have any devices with Qualcomm GNSS and we can add it back in the future if we need it again rather than porting it forward under the assumption we'll be using it</li><li>fix upstream RecoverySystem.verifyPackage(...) vulnerability (this was not directly exploitable due to there being 2 layers of update package signature verification and downgrade protection, but the first layer of protection should work properly to avoid a vulnerability in the 2nd layer being exploited)</li><li>Android Debug Bridge: more complete fix for upstream use-after-free bug for network-based connections which is being caught by our always enabled hardware memory tagging support for the base OS in hardened_malloc</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.83</li><li>Seedvault: update to 15-5.5 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.79.0">version 135.0.7049.79.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/88">version 88</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/27">version 27</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/28">version 28</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025040700">2025040700</a></h3><p>This is an early April security update release based on the April 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025040700">2025040700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025040400 release:</p><ul><li>full 2025-04-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025040400">2025040400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025040400">2025040400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025032500 release:</p><ul><li>Sandboxed Google Play compatibility layer: remove StatsManager from hidden services and replace that approach with stubbing out all of the methods since Play services recently introduced new code using it that's missing a null check and triggers a null pointer exception which has blocked us from pushing out the newer versions of Play services beyond our App Store's Alpha channel</li><li>Network Location: switch to making at most a single request to the service per position estimation by requesting up to 40 Wi-Fi APs at once</li><li>Network Location: optimize making requests to the service for Wi-Fi AP data</li><li>Network Location: optimize Rust JNI bindings to the point that it no longer causes a noticeable overhead without introducing unsafe code (it could be optimized further with unsafe code to cache more JNI binding work but the difference is insignificant so we don't plan to do it)</li><li>Network Location: use correct Accept header value to more closely match macOS to avoid future compatibility issues</li><li>fix upstream system_server crash from null pointer exception in F2fsUtils</li><li>add infrastructure for more restricted access to global and per-user settings instead of allowing all system apps to read them and all privileged systems apps with the WRITE_SECURE_SETTINGS privileged permission to write them</li><li>further restrict access to all global and per-user settings added by GrapheneOS with our new infrastructure</li><li>replace disabling the unused ADD_USERS_WHEN_LOCKED and ENABLE_EPHEMERAL_FEATURE settings at boot with a new approach of making settings immutable in the code, which we can expand in the future to other problematic settings not used by GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.131</li><li>kernel (6.1): drop revert for upstream USB fix causing DisplayPort alternate mode regression due to another upstream patch successfully fixing it</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.38.0">version 135.0.7049.38.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-155">version 155</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-156">version 156</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025032500">2025032500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025032500">2025032500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025032100 release:</p><ul><li>Network Location: rewrite position estimation in Rust (from Kotlin) with a new algorithm based on Expectation-Maximization (EM) always using 3D (altitude) to provide much better accuracy, robustness and performance (this new 3D implementation performs better than the previous implementation in the 2D mode we were stuck using due to 3D being far too CPU intensive)</li><li>Network Location: improve RSSI-based (signal strength) distance estimation including tuning it separately for 2.4GHz vs. 5GHz/6GHz and take distance variance into account for position estimation (Wi-Fi Round-Trip-Time support will be added in the future for Access Points supporting it)</li><li>Network Location: add support for 6GHz Wi-Fi networks via Reduced Neighbor Report (RNR)</li><li>Network Location: increase the number of closest APs we explicitly request data for from 5 to 15</li><li>Network Location: request data for up to 4 APs at a time instead of only 1 to improve networking efficiency</li><li>Network Location: make our requests more closely match a current macOS release to avoid future compatibility issues and to get Apple's service to provide more than only 2.4GHz networks as nearby networks in response to queries</li><li>Network Location: reduce requesting data for 100 additional nearby Wi-Fi APs down to 8 APs when a decent amount of additional results were returned from a recent request for up to 100 in the past 10 seconds</li><li>backport upstream brightness fluctuation fix from Android 16 Beta 3.1</li><li>Sandboxed Google Play compatibility layer: fix Location Accuracy link with Play services 25.09 and later so we can ship it as an update for users with sandboxed Google Play installed</li><li>Sandboxed Google Play compatibility layer: remove no longer supported "Configure Play Store updates" settings since we always handle updates ourselves via our App Store now</li><li>fix an upstream screenshot process crash in ScrollCaptureController</li><li>Terminal (virtual machine management app): backport upstream improvements including detecting an outdated image to providing an upgrade path and removing the artificial cap on disk resize</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.135.0">version 134.0.6998.135.0</a></li><li>only block installing out-of-band APEX updates on production (user) builds since it's useful for development</li><li>add support for testing Android 16 Beta 3 feature flags for development builds</li><li>begin porting our changes to work with Android 16 feature flags</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025032100">2025032100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025032100">2025032100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025031400 release:</p><ul><li>Sandboxed Google Play compatibility layer: improve support for overriding Gservices flags to avoid situations where our overrides aren't used leading to compatibility issues (this should fix a recent Play services crash that's being reported)</li><li>Sandboxed Google Play compatibility layer: improve support for overriding phenotype flags and fix flag overrides not being applied in some cases</li><li>fix 2 upstream lockscreen layout bugs with split shade used on folding phones (for the inner screen) and tablets</li><li>fix upstream lockscreen layout bug with placement of alarm and Do Not Disturb information</li><li>fix upstream lockscreen layout bug hiding date text when media is playing</li><li>enable support for the new desktop mode as an additional developer option toggle (Pixel Tablet already has this as the main toggle)</li><li>Terminal (virtual machine management app): backport upstream improvements</li><li>System Updater: raise download buffer size</li><li>System Updater: delete update package immediately after completion</li><li>System Updater: fall back to downloading and installing a full update if an incremental (delta) update fails initialization which occurs when a firmware or OS image has been corrupted (extremely rare edge case due to verified boot)</li><li>System Updater: retry faster if installation fails</li><li>System Updater: improve error checking to provide better error messages</li><li>System Updater: close update package zip file earlier</li><li>Network Location: require TLSv1.3 for GrapheneOS services instead of either TLSv1.2 or TLSv1.3</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Seedvault: update to 15-5.4 (will be replaced with a better backup implementation in the future)</li><li>stop disabling inclusion of device diagnostics functionality now that it's available in the Android Open Source Project</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.108.0">version 134.0.6998.108.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025031400">2025031400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025031400">2025031400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025031300 release:</p><ul><li>Sandboxed Google Play compatibility layer: add back default values to the API definitions for our reimplementation of the Google Play location service since dropping them in the previous release (2025031300) broke compatibility with a subset of apps and prevented us moving it past our Alpha channel (all the improvements from the previous release are still present)</li><li>adevtool: fix support for checking stock OS kernel revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025031300">2025031300</a></h3><p>This release greatly improves the experimental virtual machine management app with many backports from the Android Open Source Project main branch. You'll need to install Android's latest Debian-based image in order to continue using it. You'll be prompted to do this at startup after it fails to start with the old setup with an opportunity to back up the data. The data inside it should continue to be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025031300">2025031300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030900 release:</p><ul><li>Sandboxed Google Play compatibility layer: overhaul our default enabled reimplementation of the Google Play location service (location request rerouting) to provide much better compatibility for apps depending on network-based location by always telling apps that the Google Improve Location Accuracy toggle is enabled and providing fallback to GNSS for low power location requests when the OS network location service is disabled as it is by default (unlike Google Play services, which has no fallback, but apps assume users enable the feature)</li><li>fix Storage Scopes related null pointer exception in the permissions manager</li><li>Bluetooth: backport fix for empty adapter name handling in Android 15 QPR2 to avoid crashes when the name is set to an empty value or whitespace</li><li>Terminal (virtual machine management app): backport a large set of improvements including terminal tabs, working port forwarding, GUI support with opt-in GPU hardware acceleration (ANGLE-based VirGL until GPU virtualization support is available), speaker/microphone support and fixes for a bunch of bugs including overly aggressive timeouts</li><li>Settings: add Terminal app toggle to System category when developer options are enabled (requirement will be dropped when it's no longer experimental) so it can be enabled in other users (it's still currently only possible to use 1 instance at a time due to conflicting use of an internal network specific to virtual machine management)</li><li>Pixel 8 Pro, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix support for enabling UWB (ultra wideband) radio by adding missing SELinux policy to avoid the UWB service chain crashing and burning CPU</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.130</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.82</li><li>Seedvault: update to 15-5.3 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.95.0">version 134.0.6998.95.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/83">version 83</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030900">2025030900</a></h3><p>This release adds support for the experimental virtual machine management app introduced in Android 15 QPR2. It currently only provides support for managing a single VM and interacting with it via a WebView-based terminal. Android is in the process of adding support for graphics and GPU acceleration for a future release. For now, it's only available in developer options due to being highly experimental. We don't recommend using developer options on a production device, but you can temporarily enable it to turn on this feature and turn them back off without it being disabled like most developer options. The data inside it should currently be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update. We plan to support choosing other guest operating systems beyond the Debian-based image provided by Android along with taking far more advantage of the virtualization infrastructure.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030900">2025030900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030800 release:</p><ul><li>SystemUI: re-enable migrate_clocks_to_blueprint and communal_hub flags with workarounds for upstream issues when using standard AOSP UI components instead of Pixel OS components</li><li>Android Debug Bridge: fix upstream crash caused by a race condition that sometimes unregistered a closed file descriptor from epoll</li><li>Sandboxed Google Play compatibility layer: fix issue breaking RPC transactions which impacts the Terminal app</li><li>Sandboxed Google Play compatibility layer: add implementation of isGoogleLocationAccuracyEnabled() to the location rerouting implementation always returning true to fix compatibility with apps checking for it</li><li>Sandboxed Google Play compatibility layer: fix definition of IStatusCallback.onCompletion() to slightly improve performance</li><li>allow Terminal app to use WebView JIT since it requires WebAssembly</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.80</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030800">2025030800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030800">2025030800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030700 release:</p><ul><li>SystemUI: temporarily disable migrate_clocks_to_blueprint and communal_hub flags again to avoid upstream Android 15 QPR1 lockscreen layout regressions which are still present in Android 15 QPR2 until we resolve them, which will be prioritized now</li><li>SystemUI: make screenshot sound use sound effects setting again (our change stopped working from the Android 15 QPR2 port)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030700">2025030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030700">2025030700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030500 release:</p><ul><li>Wallpaper Picker: backport upstream fix for an Android 15 QPR2 bug causing the UI for picking the wallpaper to be blank</li><li>fix upstream system_server crash introduced in Android 15 QPR2 related to Bluetooth telephony integration</li><li>backport upstream fixes for 13 different system_server null pointer exception crashes, an array out of bounds system_server exception and an NFC resolver activity null pointer exception</li><li>backport upstream fix for voice volume adjustments in certain apps</li><li>adevtool (Pixel Tablet): remove unintentional deviation from standard memory pinning configuration</li><li>adevtool: remove unnecessary PersistentBackgroundServices app</li><li>adevtool: filter out config_pluginAllowlist SystemUI overlay to avoid breaking the clock layout by referring to non-AOSP SystemUI clocks</li><li>Sandboxed Google Play compatibility layer: fix Google Play Services for AR not being installable from the Play Store anymore</li><li>Sandboxed Google Play compatibility layer: fix development option for installing the Pixel Thermometer (Pixel Health) app</li><li>add inet group for vmnic (virtual machine networking functionality) to make it compatible with our group-based Network permission enforcement used as another layer of security</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/82">version 82</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030500">2025030500</a></h3><p>This release is based on Android 15 QPR2, the second quarterly release of Android 15. All of the supported devices are now using the Linux 6.1 LTS branch so the 5.10 and 5.15 branches are retired for GrapheneOS. 6.6 continues to be used for microdroid virtual machines on devices and for emulator builds, which will likely move to 6.12 this year.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030500">2025030500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030300 release:</p><ul><li>full 2025-03-05 security patch level</li><li>rebased onto BP1A.250305.020.T2 Android Open Source Project release (initial Android 15 QPR2 release)</li><li>Settings: replace our approach to making the Unrestricted battery mode more visible due to changes in Android 15 QPR2</li><li>drop 8 downstream GrapheneOS patches for upstream Android bugs which should no longer be required due to upstream fixes in Android 15 QPR2</li><li>kernel (Pixel 7a): temporarily disable RANDSTRUCT due to a Qualcomm Wi-Fi driver incompatibility (only the Pixel 7a uses Qualcomm Wi-Fi and RANDSTRUCT wasn't enabled before Android 15 QPR2 for 6th/7th/8th gen Pixels since they weren't on 6.1 yet)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030300">2025030300</a></h3><p>This is an early March security update release based on the March 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR2) scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030300">2025030300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030200 release:</p><ul><li>full 2025-03-01 security patch level</li><li>Network Location: temporarily disable using altitude in trilateration for now because 3D trilateration is using an excessive amount of CPU time and we need to greatly optimize it with algorithm level improvements, porting it to Rust and other optimizations before we can use 3D</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/29">version 29</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/30">version 30</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030200">2025030200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030200">2025030200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030100 release:</p><ul><li>Sandboxed Google Play compatibility layer: remove requestLocationSettingsDialog() implementation due to apps implicitly depending on it behaving in a very specific way</li><li>Sandboxed Google Play compatibility layer: add isHybridLocationServiceEnabled() API</li><li>Sandboxed Google Play compatibility layer: skip redundant location settings check activity when rerouting is on</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030100">2025030100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030100">2025030100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025022800 release:</p><ul><li>Network Location: improve integration of altitude into trilateration to properly account for not all networks providing it including avoiding an edge case null pointer exception</li><li>Network Location: add default enabled data saver exemption</li><li>Network Location: use hideFromAppOps as documented by the Android API documentation for a network location service to match how the AOSP satellite-based location services and the Play services location services in the stock OS work (this likely avoids the need for the exemption from the GrapheneOS location indicator but we're keeping that for now to avoid wasting development time determining it)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025022800">2025022800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025022800">2025022800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025022700 release:</p><ul><li>restrict "5G only" mode to carriers with 5G standalone support to avoid setting the option silently failing</li><li>fix ancient upstream bug causing system_server crashes when flushing an inactive location provider which was uncovered by us adding our own network location provider</li><li>exclude network location provider from the GrapheneOS location indicator since it's meant to be shown for apps requesting location rather than showing users when the OS location services listen for GNSS satellite broadcasts and scan nearby networks</li><li>Sandboxed Google Play compatibility layer: fix issues in our requestLocationSettingsDialog() implementation which were uncovered by providing our own network location provider (this is part of our reimplementation of the Google Play location service used when rerouting Google Play location requests to the OS is enabled which is the default)</li><li>Network Location: add built-in battery optimization exception to avoid being blocked from accessing the network from the background in some cases</li><li>Network Location: incorporate altitude into trilateration when available to replace basic altitude support based on averages which wasn't taken into account for the latitude/longitude estimation (i.e. it now operates in 3D instead of 2D)</li><li>Network Location: add TLS key pinning for gs-loc.apple.grapheneos.org</li><li>kernel (6.6): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025022700">2025022700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025022700">2025022700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025021100 release:</p><ul><li>add opt-in GrapheneOS network location implementation available via Settings &gt; Location &gt; Location services based on using the Apple Wi-Fi positioning API either through a GrapheneOS proxy or directly via Apple's service, which will be extended with much more functionality in the near future including incorporating altitude into trilateration, using cell towers if it provides a better estimate than Wi-Fi and using our own network location database either via a service or offline database downloads (we're in the process of building our own database initially based on collecting most of the data from Apple's service and have already done a test run obtaining essentially all the cell tower data along with lots of Wi-Fi data)</li><li>fix Wi-Fi APEX issues preventing an OS network location service from doing Wi-Fi scans without the INTERACT_ACROSS_USERS / INTERACT_ACROSS_USERS_FULL privileged permissions</li><li>Sandboxed Google Play compatibility layer: add support for using an OS network location provider for the default enabled rerouting of Google Play location requests to the OS location service</li><li>add support for "5G only" and "4G or 5G only" modes in addition to our existing "4G only" mode</li><li>enable support for blocking callers not in Contacts</li><li>resolve regression for secondary user SMS in Android 15 QPR1 by enabling partial upstream fix since we dropped this part of our fix for the issues but the upstream fix wasn't actually active</li><li>fix Storage Scopes / Contact Scopes app settings link not working for apps in nested profiles in some cases</li><li>Launcher: limit 4x5 grid option to phones</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.79</li><li>backport mainline APEX module patches for DocumentsUI, Media Provider and Network Stack</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.89.0">version 133.0.6943.89.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.121.0">version 133.0.6943.121.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.137.0">version 133.0.6943.137.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.39.0">version 134.0.6998.39.0</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/27">version 27</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/28">version 28</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/5">version 5</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/6">version 6</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/7">version 7</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/21">version 21</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/22">version 22</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/23">version 23</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/24">version 24</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/25">version 25</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/26">version 26</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/79">version 79</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/80">version 80</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/81">version 81</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025021100">2025021100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025021100">2025021100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020500 release:</p><ul><li>kernel (5.10, 5.15, 6.1, 6.6): zero memory in early boot in case it wasn't zeroed by the OS as part of a clean reboot or shutdown since there isn't fully encrypted RAM with a per-boot key yet (early boot zeroing is implemented by Pixel boot firmware since April 2024 for booting into fastboot mode but not booting into the OS since they only partially implemented our January 2024 reset attack protection proposal, so we need to handle the OS part ourselves)</li><li>kernel (6.1): add back revert for upstream Linux kernel fix which was reapplied in our <a href="https://grapheneos.org/releases#2025020200">2025020200</a> release without any reports of issues for days because it has been found to break DisplayPort alternate mode on 9th generation Pixels</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.128</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.76</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): backport Wi-Fi driver patch from Android 15 QPR2 Beta 3 in an attempt to avoid a rare invalid read-after-free detected by hardware memory tagging</li><li>Launcher: add 4x5 grid option</li><li>remove infrastructure for our legacy software-based USB peripheral blocking since we've replaced it with <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control">a far better feature using both hardware and software USB connection/data blocking</a> across all supported devices</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/78">version 78</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020500">2025020500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020500">2025020500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020300 release:</p><ul><li>full 2025-02-05 security patch level</li><li>rebased onto AP4A.250205.002 Android Open Source Project release</li><li>drop our workaround for upstream audio routing permission bug impacting Android Auto and likely other apps that's no longer required due to an upstream fix in the monthly February release</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to Mali GPU kernel driver from Android 15 QPR2 Beta 3 to include additional security fixes</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.49.0">version 133.0.6943.49.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-154">version 154</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020300">2025020300</a></h3><p>This is an early February security update release based on the February 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020300">2025020300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020200 release:</p><ul><li>full 2025-02-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020200">2025020200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020200">2025020200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025012700 release:</p><ul><li>reimplement our fix for an upstream audio routing regression in Android 15 QPR1 impacting sandboxed Android Auto and likely other apps to avoid blocking another subset of apps from changing audio routing when granted permission</li><li>Sandboxed Google Play compatibility layer: add support for enabling Google's credential service via Settings &gt; Passwords, passkeys &amp; accounts by making it function as an unprivileged service (non-Chromium-based apps tend to require this to use Google as the passkey service and it's needed by certain apps for their Sign in with Google option despite Android intending to fully support other credential services)</li><li>Sandboxed Google Play compatibility layer: allow disabling all Play Integrity API notifications instead of only disabling them per-app</li><li>Sandboxed Google Play compatibility layer: override Play services update owner value to the GrapheneOS App Store to fully handle updates for it ourselves</li><li>work around upstream Android issue caused by an optimization which was adding a 10 second delay to certain setting changes before they kick in for background system packages</li><li>kernel (5.15): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.126</li><li>kernel (6.1): drop revert for upstream USB fix causing DisplayPort alternate mode regression to test if it's still needed due to lots of other backported changes</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.74</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.39.0">version 133.0.6943.39.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.39.1">version 133.0.6943.39.1</a></li><li>remove same version ABI stability check not useful for GrapheneOS</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025012700">2025012700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025012700">2025012700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025012600 release:</p><ul><li>fix regression in the previous release for configuring per-app settings added by GrapheneOS for apps in the work profile or Private Space when the Settings app is launched from the Owner user rather than the work profile or Private Space (this was caught during Alpha channel testing and is why it didn't proceed to Beta channel testing)</li><li>avoid Settings app crashing when opening the per-app Play Integrity API menu for an already uninstalled app via a leftover notification</li><li>Sandboxed Google Play compatibility layer: improve Play Integrity API description</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025012600">2025012600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025012600">2025012600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025011500 release:</p><ul><li>disable standard Android feature holding a 10 minute screen wake lock after the screen brightness is raised at least 2 times within 5 minutes since this is confusing for users and it's far better if keep awake is done explicitly</li><li>always show Linux kernel crash notifications from hardware memory tagging (Hardware Tag-Based KASAN) instead of only when system crash reporting is enabled by users</li><li>Messaging: begin under the hood overhaul including fully porting to target API 35 (Android 15)</li><li>recovery: remove spurious warning after sideloading an update fails on A/B update devices</li><li>change build username and hostname to match the stock Pixel OS format instead of setting both to grapheneos due to bad actors using it to ban using GrapheneOS</li><li>return green as the value of ro.boot.verifiedbootstate for user installed apps (not the base OS or system apps) due to bad actors using it to ban using GrapheneOS</li><li>SettingsIntelligence: don't show preference summaries in search results since it doesn't work properly for ones depending on dynamic string formatting and isn't done by SettingsIntelligenceGoogle on the stock Pixel OS</li><li>Contact Scopes: fix spoofing of OP_GET_CONTACTS for apps not requesting WRITE_CONTACTS</li><li>Sandboxed Google Play compatibility layer: improve infrastructure</li><li>Sandboxed Google Play compatibility layer: allow blocking the Sandboxed Google Play is running notification</li><li>Sandboxed Google Play compatibility layer: add per-app Play Integrity menu in the per-app Settings configuration that's shown after an app uses the Play Integrity API</li><li>Sandboxed Google Play compatibility layer: add per-app toggle for blocking using the Play Integrity API via the per-app Play Integrity menu as a workaround for apps which ban devices based on it but don't require providing it to their service yet</li><li>Sandboxed Google Play compatibility layer: add shortcut to the per-app Play Integrity API menu for contacting the app developer by leaving a review through the Play Store page</li><li>Sandboxed Google Play compatibility layer: add menu for viewing all apps which have used the Play Integrity API with a shortcut in the per-app Play Integrity API menu</li><li>Sandboxed Google Play compatibility layer: show optional notification upon detection of Play Integrity usage providing a shortcut to the per-app Play Integrity API menu and another for hiding further notifications for the app which is also available as a toggle in the per-menu</li><li>hardened_malloc: update libdivide to 5.2.0</li><li>TalkBack (screen reader): update dependencies</li><li>TalkBack (screen reader): make builds fully reproducible by removing the use of __DATE__ and __TIME__ by brltty along with making the liblouis translation table zip use deterministic file order and timestamps</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.124</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.68</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.0">version 132.0.6834.79.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.1">version 132.0.6834.79.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.2">version 132.0.6834.79.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.122.0">version 132.0.6834.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-153">version 153</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025011500">2025011500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025011500">2025011500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025010700 release:</p><ul><li>fix upstream Android lockscreen bug triggered by the combination of fully disabling animations (via Settings &gt; Accessibility &gt; Color and motion &gt; Remove animations) and enabling always-on display (Settings &gt; Display &gt; Lock screen &gt; Always show time and info) which results in the locking process getting stuck and not considering the device locked until it wakes again due to not skipping animations as intended (this did not create a lockscreen bypass but did result in valid biometric unlock credentials skipping restrictions)</li><li>add protection against upstream lockscreen bugs bypassing restrictions on biometric unlocking while the device is asleep including the standard restrictions and our recently added 2-factor fingerprint unlock feature</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): enable hardware memory tagging for the main kernel allocators via the upstream Hardware Tag-Based KASAN implementation (which is intended for production usage, unlike the other KASAN modes)</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch KASAN fault handling from report to panic to use it as a hardening feature instead of only a bug finding tool</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch KASAN hardware memory tagging mode from synchronous to asymmetric for the initial deployment to reduce the performance cost and match our existing hardware memory tagging usage in userspace (synchronous mode is potentially more useful in the kernel than it is for userspace which is something we can investigate and potentially offer as an option)</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): disable our slab canary feature since it's incompatible with the kernel's hardware memory tagging and will be fully obsolete after we've made basic improvements to the upstream hardware memory tagging implementation</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.233</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.176</li><li>kernel (5.15): merge latest GKI tag to incorporate important security and other patches including the patch for CVE-2024-56556 which are not included in the latest kernel.org release (5.15.176) or the latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Updater: require TLSv1.3 instead of either TLSv1.2 or TLSv1.3</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>System UI Tuner: opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bug)</li><li>make eng builds more consistent with user/userdebug builds by extending the GrapheneOS additions of the ro.control_privapp_permissions=enforce, net.tethering.noprovisioning=true and ro.sys.time_detector_update_diff=50 system properties to all build variants</li><li>show a system error notification for privileged permission allowlist violations in development builds (userdebug and eng builds) instead of breaking booting the device to make developing device support and porting to new OS versions easier</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025010700">2025010700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025010700">2025010700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024123000 release:</p><ul><li>full 2025-01-05 security patch level</li><li>rebased onto AP4A.250105.002 Android Open Source Project release</li><li>provide standard haptic feedback for fingerprint authentication success when 2nd factor PIN is enabled</li><li>add workaround for upstream SystemServiceManager.newTargetUser null pointer exception bug crashing system_server</li><li>add workaround for upstream BatteryStatsImpl.updateWifiBatteryStats divide by zero bug crashing system_server</li><li>Contacts: improve dark theme contrast for empty contacts list background</li><li>backport mainline APEX module patches for Media Provider, Network Stack and Wi-Fi</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.175</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.123</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.65</li><li>Sandboxed Google Play compatibility layer: fix implementation of getCurrentLocation() to return SUCCESS even when the result is null to avoid some edge case issues</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/76">version 76</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/77">version 77</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.260.0">version 131.0.6778.260.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024123000">2024123000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024123000">2024123000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024121200 release:</p><ul><li>add support for adding a PIN as a 2nd factor to fingerprint unlock to enable our new recommended high threat model configuration of a random diceware passphrase as the primary unlock method and fingerprint+PIN with a random 4-6 digit PIN as the regularly used secondary unlock method (the usual limitations of secondary unlock only being usable for 48 hours after successful primary unlock and our limit of 5 total secondary unlock attempts apply)</li><li>add support for limiting charging the battery to 80% with support for bypass charging similar to the new Android 15 QPR1 stock Pixel OS feature, although unlike the stock Pixel OS our implementation still works while using a secondary user (the limit is currently hard-wired to 80% due to that being what's fully supported for the stock OS usage, but we can eventually make it configurable)</li><li>add support for disabling dynamic code loading via storage for all user installed apps by default as we already do for the dynamic code loading via memory setting instead of only being able to opt-in to the restriction on a per-app basis</li><li>allow dynamic code loading from storage by default for apps depending on Play services due to the legacy dynamite module implementation not yet being fully replaced by split APKs to avoid users encountering a huge number of issues if they disable it by default for user installed apps (users can still disable it for these apps manually and we won't need to keep this exception forever since Google is moving to split APKs for dynamite modules)</li><li>add support for partially recompiling apps (speed-profile) in the Finalizing step of OS updates to skip partially recompiling them during boot, but while still doing most of the work after boot in the background (speed) to avoid slowing down OS update installation too much</li><li>remove adding back boot-time display of app compilation progress now that it's no longer heavily used</li><li>use 2 threads instead of 1 for background compilation of apps</li><li>switch to the new upstream default of 4 threads for compiling apps during boot instead of our previous 2 threads which we set to replace the previous upstream default of a single thread</li><li>Settings: add back battery optimization settings link to Battery screen which was removed by Android a long time ago</li><li>Settings: don't disable App info &gt; Battery usage item while its summary is loading</li><li>Settings: temporarily stop showing battery usage info in App info item summary due to an upstream regression causing it to take more than 5 seconds to load in many cases</li><li>add back our fix for an upstream Android bug causing null pointer exception system_server crash in InputMethodManagerService triggered when ending user sessions because it turns out to still be required after Android 15 QPR1</li><li>fix upstream Android bug causing null pointer exception system_server crash in NotificationManagerService</li><li>Contacts: improve dark theme color contrast</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.232</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.173</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.119</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.61</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): fix very minor Android 15 QPR1 regression causing the kernel commit hash to be omitted from the kernel version string and the Unix epoch to be used as the build time instead of the kernel commit timestamp</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/75">version 75</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.200.0">version 131.0.6778.200.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-152">version 152</a></li><li>add developer option to log binder transactions</li><li>fix ignoring harmless fingerprint-service.goodix crash for our system service crash reporting</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024121200">2024121200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024121200">2024121200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120900 release:</p><ul><li>SystemUI: disable migrate_clocks_to_blueprint and communal_hub flags to avoid upstream Android 15 QPR1 lockscreen layout regressions</li><li>fix upstream bug causing the Microphone (RECORD_AUDIO) permission to be required for for local audio routing via REMOTE_SUBMIX instead of only the MODIFY_AUDIO_ROUTING permission with this explicit purpose (this caused Android Auto to require the Microphone permission for routing audio on both the stock OS and GrapheneOS, but it impacts GrapheneOS more due to permissions not being granted by default to Android Auto and most people not wanting to give it the Microphone permission)</li><li>Settings: show current app battery usage mode in summary of App battery usage item</li><li>Settings: add back Unrestricted battery usage option to App battery usage screen to undo the usability regression introduced by Android 14 QPR2 where Optimized vs. Unrestricted was hidden away in an inner mode accessed by pressing the text next to an allow background toggle for controlling the Restricted mode (they likely did this to discourage users enabling Unrestricted, but GrapheneOS users need this much more than stock OS users especially if they don't use sandboxed Google Play and the new UI is very confusing/misleading instead of simply giving users a direct choice between the 3 modes)</li><li>Dialer: add proper dark mode support for dialogs</li><li>Android Debug Bridge: fix upstream use-after-free bug for network-based connections which is being caught by our always enabled hardware memory tagging support for the base OS in hardened_malloc</li><li>Android Debug Bridge: backport support for v4 signatures in streaming app installs from Android's development branch to support updating GrapheneOS apps directly with the streaming-based ADB install commands instead of needing to push them to the device and then install them (this stopped working after Android 15 since we had to replace signed fs-verity metadata with v4 signatures for our implementation of extending verified boot to system APK updates to close a major security hole in standard Android verified boot)</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.135.0">version 131.0.6778.135.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120900">2024120900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120900">2024120900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120702 release:</p><ul><li>Sandboxed Google Play compatibility layer: fix Android Auto Bluetooth audio regressions from Android 15 QPR1</li><li>CarrierConfig2 (app created by GrapheneOS to replace Google CarrierSettings): add support for new ICCID MVNO type in Android 15 QPR1</li><li>CarrierConfig2: add support for new ApnItem fields Android 15 QPR1</li><li>CarrierConfig2: change user-facing carrier settings version string prefix to match Google Carrier Settings to avoid confusion when comparing to the stock OS</li><li>delay activation of the Allow button for the Android Debug Bridge USB authorization dialog by 1 second to make it much harder to accidentally grant access</li><li>Permission Controller: delay activation of the Allow button(s) for runtime permission dialogs by 1 second to make it much harder to accidentally grant access</li><li>Permission Controller: disable all caps text theme by default to match the Settings app style</li><li>Permission Controller: move "Turn off" action from overflow menu to the toolbar for both Storage Scopes and Contact Scopes</li><li>Permission Controller: fix Contact Scopes UI issue where "Allow" could still be selected in the permission menu with Contacts Scopes enabled which would not actually disable Contact Scopes and allow the permission</li><li>Settings: add a dedicated App info &gt; Storage &gt; Manage storage button for apps with a manage storage space activity instead of replacing the standard user interface with it especially since the app's own implementation may not support clearing all storage and may not work at all</li><li>Settings: fix minor back navigation issue for our duress PIN/password UI where it would open a new authentication activity instead of going back to the previous screen</li><li>prevent crashes caused by upstream Android bugs when a Mock Location provider is added or removed by avoiding ever removing location providers at runtime by keeping them around as disabled providers</li><li>stop temporarily always enabling system crash notifications since the initial Android 15 QPR1 testing is completed</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.228</li><li>adevtool: update carrier_settings and carrier_list protobuf parsers for Android 15 QPR1</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120702">2024120702</a></h3><p>This release is specific to 9th generation Pixels and is being published to provide a proper fix for the GPU driver regression we ran into with Android 15 QPR1 so we can switch back to the standard GrapheneOS Linux 6.1 GKI LTS branch.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120702">2024120702</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024120701 release:</p><ul><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch back to standard GrapheneOS 6.1 kernel based on 6.1.118 instead of the tag based on 6.1.84 for AOSP and the stock OS which was used as a workaround for a Mali GPU kernel driver bug in the previous OS release</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to Mali GPU kernel driver from Android 15 QPR2 Beta 1 which includes a fix for the massive mmap bug which caused lag and both app/system wide stalls/crashes with a newer LTS kernel revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120701">2024120701</a></h3><p>This release is specific to 9th generation Pixels and is being published to provide a temporary workaround for a major Mali GPU kernel driver issue introduced in Android 15 QPR1. The issue was caught during our Alpha channel testing and resulted in the last release being cancelled for 9th generation Pixels.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120701">2024120701</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024120700 release:</p><ul><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): temporarily switch to a dedicated GKI kernel branch based on the much older revision used by the stock OS and AOSP (6.1.84 instead of 6.1.118) to resolve major Mali GPU kernel driver regressions, which can then be narrowed down further after we have an initial workaround for the crashes/stalls caused by the driver changes</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120700">2024120700</a></h3><p>This release is based on Android 15 QPR1, the first quarterly release of Android 15.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120700">2024120700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120400 release:</p><ul><li>full 2024-12-05 security patch level</li><li>rebased onto AP4A.241205.013 Android Open Source Project release (December quarterly release of Android 15)</li><li>temporarily always enable system crash notifications to help users find Android 15 QPR1 regressions</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.227</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.1): add back one of the two f2fs defragmentation patches we reverted now that it's backported in Android 15 QPR1, since the other change was the source of the major regression rather than this one and it now has broad testing upstream without the broken change we still have reverted</li><li>kernel (Pixel Tablet): make SYN43752 Wi-Fi/Bluetooth driver build reproducible by dropping Broadcom's inclusion of the absolute path to the build directory as we've already done for all other 6th/7th/8th generation Pixels</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): make BCM4390 Wi-Fi/Bluetooth driver build reproducible by dropping Broadcom's inclusion of the absolute path to the build directory as we've already done for 6th/7th/8th generation Pixels</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120400">2024120400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120400">2024120400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120200 release:</p><ul><li>Gallery: remove the Delete option for items that represent multiple images since the UI is badly designed and makes it too easy to accidentally delete images, especially since the app doesn't support the Trash API</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.104.0">version 131.0.6778.104.0</a></li><li>switch back to correct APK for Vanadium Config to fix using our full content filter list and to unblock out-of-band updates (this regressed in the <a href="https://grapheneos.org/releases#2024112700">2024112700</a> OS release and was noticed with the new Vanadium release)</li><li>envsetup.sh: reuse BUILD_DATETIME and BUILD_NUMBER from environment to make automation for reproducible builds slightly simpler instead of needing to export them after sourcing envsetup.sh</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120200">2024120200</a></h3><p>This is an early December security update release based on the December 2024 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR1) scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120200">2024120200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024112700 release:</p><ul><li>full 2024-12-01 security patch level</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.118</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.58</li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/20">version 20</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-151">version 151</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024112700">2024112700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024112700">2024112700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024111800 release:</p><ul><li>Settings: revert our previous attempt at disabling Bluetooth contact sharing by default for hands-free calling devices in our <a href="https://grapheneos.org/releases#2024111700">2024111700</a> release because it didn't address an upstream Android security bug and having the toggle off by default caused the upstream bug to impact pairing directly in the Settings app (foreground) if the user would have toggled it off instead of only outside the Settings app such as through the Bluetooth Quick Tile (background)</li><li>Settings: fix an upstream Android security bug causing Bluetooth contact sharing to be enabled for hands-free calling devices even though the dialog shows it will be disabled, which only previously occurred for pairing invoked from outside the Settings app but also began impacting pairing from within it due to disabling the contact sharing setting by default</li><li>Settings: always disable Bluetooth contact sharing by default instead of enabling it by default for pairing requests made by the user in the foreground where the user can choose to disable it</li><li>fix upstream bug breaking in-call service components provided by packages only installed in secondary users, which was mainly occurring with user installed Android Auto which unlike the stock OS isn't installed in Owner by default to mask this bug</li><li>Sandboxed Google Play compatibility layer: allow Android Auto foreground services to have while-in-use permissions when wired and/or wireless Android Auto special permissions are granted by the user to fix voice commands in some cases</li><li>Sandboxed Google Play compatibility layer: make Google text-to-speech app queryable by other apps in the same profile by default as it is on the stock OS since libraries using it don't declare the query explicitly (note apps and their libraries can declare any queries they want including for any app with a launcher activity and there's no approval along with there being other ways to detect apps)</li><li>Sandboxed Google Play compatibility layer: show the notification for Play services not having Unrestricted battery usage enabled one more time for existing users since not having it now causes more severe delays FCM push messaging including notifications or more urgent events such as incoming calls to an app like Signal which uses FCM for this when available</li><li>Sandboxed Google Play compatibility layer: add notification about Play services having background data usage restricted which will break FCM when only mobile data is available (no Wi-Fi access)</li><li>Sandboxed Google Play compatibility layer: don't show battery usage notification for Play services when it has the Network toggle revoked since the user clearly doesn't want the functionality depending on Unrestricted background power usage</li><li>Settings: opt-out of Android 15 edge-to-edge for the developer options app picker activity since it's not properly supported yet (upstream bug)</li><li>Setup Wizard: avoid incredibly rare edge case crash (uncaught exception) when trying to disable OEM unlocking when it's already disabled and not allowed to be disabled by the carrier</li><li>fix avoiding reporting harmless fingerprint-related crash with our added crash reporting</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.57</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.81.0">version 131.0.6778.81.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-150">version 150</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024111800">2024111800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024111800">2024111800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024111700 release:</p><ul><li>temporarily revert putting Private Space data at rest when locking it because some users want to be able to unlock it with their fingerprint so we need to make this into a toggle rather than hard-wired (will be added back in a near future release as an option)</li><li>switch default display color mode to Natural for fresh installs for more accurate image/video colors and to avoid bugs tied to the other options</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024111700">2024111700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024111700">2024111700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024110700 release:</p><ul><li>Private Space: put data at rest immediately after stopping the profile to match user profile behavior instead of only on reboot</li><li>fix Mock Location on devices without any standard location providers (only Pixel Tablet)</li><li>backport mainline APEX module patches for ART, DNS Resolver, DocumentsUI, Media, Media Provider, Network Stack, PermissionController, Remote Key Provisioning and Wi-Fi</li><li>raise maximum running users from the standard 3 to 4 for 6GB memory, 6 for 8GB memory, 10 for 12GB memory and 14 for 16GB memory</li><li>Settings: disable Bluetooth contact sharing by default for hands-free calling devices</li><li>Settings: fix Private Space handling in Passwords &amp; accounts &gt; Additional services</li><li>Settings: fix multiple cases of missing user profiles handling for added settings</li><li>Dialer: fix RTT related crash from not using the correct theme configuration</li><li>Contacts Provider: work around upstream bug causing deadlock with contact scopes</li><li>temporarily don't report harmless fingerprint-service.goodix crash</li><li>temporarily disable hardened_malloc for vendor audio service due to Pixel Tablet bug</li><li>Sandboxed Google Play compatibility layer: significantly rework client side compatibility layer to avoid deadlocks and to avoid allowing starting apps with no exported components (i.e. not even a launcher activity)</li><li>Sandboxed Google Play compatibility layer: overhaul approach to raising Google Play components to the foreground to avoid it always being considered in the foreground while also solving an issue triggered in a rare edge case at startup</li><li>Sandboxed Google Play compatibility layer: stop Play Store from attempting to auto-install some system component packages, such as "Android System SafetyCore" (com.google.android.safetycore) and "Android System Key Verifier" (com.google.android.contactkeys)</li><li>Sandboxed Google Play compatibility layer: fix Android Auto voice commands not working in some cases</li><li>Sandboxed Google Play compatibility layer: fix one of the Android Auto permission toggle checks for companion devices</li><li>Sandboxed Google Play compatibility layer: extend opt-in Android Auto "Allow permissions for handling phone calls" toggle to allow access to Bluetooth adapter hardware address access for hands-free audio support with wired Android Auto rather than only wireless Android Auto where the baseline toggle already grants access to that</li><li>Sandboxed Google Play compatibility layer: don't stop apps that use Dynamite modules when Play services stops since the new version of the Dynamite client library handles dynamic re-connection without app restart and older ones will handle this by stopping</li><li>kernel (5.10, 5.15, 6.1, 6.6): disable unused TIPC protocol support</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.170</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.115</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>System Updater: show failure notification for update_engine errors</li><li>System Updater: add missing UpdateEngine.unbind() to avoid extra callbacks for progress and error reporting</li><li>System Updater: avoid treating non-404 errors such as a connection failure as lack of an incremental update</li><li>System Updater: handle a partially downloaded incremental update being removed from the server by falling back to the full update instead of retrying resuming the incremental download until the next update (this will allow us to remove an incremental for the latest available version to save storage space or work around a potential update_engine bug without it causing download resumption errors)</li><li>System Updater: delete stale update from a failed download of a previous release slightly earlier</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.102.1">version 130.0.6723.102.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.39.0">version 131.0.6778.39.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-149">version 149</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024110700">2024110700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024110700">2024110700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024110400 release:</p><ul><li>full 2024-11-05 security patch level</li><li>rebased onto AP3A.241105.007 Android Open Source Project release (November monthly release of Android 15)</li><li>ignore Person.Builder.setUri() when Contact Scopes is enabled since apps can't access the contact's URI with Contact Scopes enabled (this resolves the incompatibility between Contact Scopes and apps attaching contact information to notifications which was introduced by a November Android Security Bulletin patch)</li><li>fix "App info" uninstall dialog link added by GrapheneOS not working in some cases for secondary profile apps</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-147">version 147</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.102.0">version 130.0.6723.102.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024110400">2024110400</a></h3><p>This is an early November security update release based on the November 2024 security patch backports since a monthly Android Open Source Project and stock Pixel OS release hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024110400">2024110400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024103100 release:</p><ul><li>full 2024-11-01 security patch level</li><li>fix a bunch of upstream Android bugs breaking SMS and MMS functionality in secondary profiles, including both Android 15 regressions and pre-existing issues</li><li>backport upstream Android fix for UsageStatsDatabase locking from the AOSP main branch</li><li>Sandboxed Google Play compatibility layer: fix flag overrides being partly ignored on recent versions</li><li>add workaround for rare system_server null pointer exception crash in showShutdownDialog()</li><li>add missing null handling for extended application error report</li><li>fix upstream bug causing App Not Responding link to not work properly outside of Owner</li><li>Settings: avoid opening parent user log viewer in nested profiles (Private Space, work profile)</li><li>System Updater, GmsCompat: reduce included SettingsLib components to reduce the size of these apps from around 10MB each to below 4MB each</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-146">version 146</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024103100">2024103100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024103100">2024103100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102400 release:</p><ul><li>improve our existing fix for an upstream Android bug impacting apps using the telephony service in secondary users to fix support for disabling re-routing of Google Play location requests to the OS for fresh installs of sandboxed Google Play since the release of Android 15</li><li>Sandboxed Google Play compatibility layer: extend wired Android Auto toggle to additional methods used in edge cases</li><li>fix changing USB-C port control setting to a lower security level not fully applying until after locking and unlocking</li><li>Settings: fix per-app exploit protection toggles for Private Space</li><li>Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS</li><li>raise system log buffer size from 256KiB to 512KiB to make logs obtained by users reporting issues more useful</li><li>enable stamp configuration for microdroid kernel builds to set LOCALVERSION based on version control information as expected</li><li>kernel (6.6): disable unused hibernation support</li><li>kernel (6.6): disable unused TIOCSTI ioctl (already blocked via standard Android SELinux ioctl filtering)</li><li>kernel (6.6): disable unused cachestat system call (already blocked for apps via standard Android seccomp-bpf policy)</li><li>kernel (6.6): enable random kmalloc caches for x86_64 and microdroid too, not only bare metal arm64</li><li>kernel (6.6): enable full struct randomization for x86_64 and microdroid too, not only bare metal arm64</li><li>kernel (6.6): enable DEBUG_SG for microdroid too, not only bare metal</li><li>kernel (6.6): enable FORTIFY_SOURCE for microdroid too, not only bare metal</li><li>kernel (6.6): disable BINFMT_MISC for microdroid too, not only bare metal</li><li>kernel (6.6): disable RSEQ for microdroid too, not only bare metal</li><li>kernel (6.6): add SYSRQ restrictions for microdroid too, not only bare metal</li><li>kernel (6.6): use the same KFENCE configuration for microdroid as bare metal</li><li>mark Sensors permission as implicitly added</li><li>avoid adding Sensors permission to hasCode=false packages</li><li>improve our implementation of extending verified boot to out-of-band shared library APK updates</li><li>Log Viewer: add userType line to header in non-Owner users</li><li>Log Viewer: add targetSdk and sharedUid to package info header</li><li>System Updater: update minimum and target API level to 35 (Android 15)</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.86.0">version 130.0.6723.86.0</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/5">version 5</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/87">version 87</a></li><li>Sandboxed Google Play compatibility layer: fix development support in OS debug builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102400">2024102400</a></h3><p>Notice which will not impact most users: apps which were only installed in secondary users but not Owner before updating to Android 15 and which were then installed in Owner after updating to Android 15 will have a one-time revocation of their Network/Sensors permissions after updating to this release as a minor consequence of migrating them from Android 14 again.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102400">2024102400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102100 release:</p><ul><li>switch back our original stricter approach to DNS leak blocking from our <a href="https://grapheneos.org/releases#2024050900">2024050900</a> release with an additional fix for an Android DNS routing bug causing requests to the VPN DNS servers to be routed incorrectly, which should avoid the compatibility issues experienced with certain VPN apps when we tried to ship it before</li><li>avoid resetting Network or Sensors back to the global default after app updates in a specific case when migrating the state from Android 14 or earlier</li><li>add an extra one-time migration of Network and Sensors being disabled in Android 14 to Android 15 to work around an issue with the previous migration of the permission state which occurred for some users with some of their apps</li><li>fix ancient Android bug causing widgets to disappear from the user's home screen when the user stops, which was a major usability issue for secondary users</li><li>Keyboard: extend fix for upstream layout bug in landscape mode to fully fix it for 3-button navigation in addition to the default gesture navigation</li><li>Gallery: fix upstream cropping activity bug when both the input and output URI is the same to fix setting profile pictures for user profiles</li><li>raise backup service transport (Seedvault) timeout from 10 minutes / 5 minutes to 60 minutes / 30 minutes to handle very large backups, particularly for the device-to-device mode which includes nearly all app data</li><li>temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps (revert was not applied for Android 15 port)</li><li>Sandboxed Google Play compatibility layer: add stubs for update_engine wrapper API to avoid potential Play services crashes if the existing approaches to disable the update service fail</li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>use hardened GrapheneOS 6.6 LTS kernel for microdroid virtual machines for both arm64 and x86_64</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.73.0">version 130.0.6723.73.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-144">version 144</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-145">version 145</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102100">2024102100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102100">2024102100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102000 release:</p><ul><li>Keyboard: fix upstream bug triggered by Android 15 causing layout to be cut off in landscape mode on devices with a display cutout</li><li>enforce stack clash protection for arm64</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102000">2024102000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102000">2024102000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101900 release:</p><ul><li>Sandboxed Google Play compatibility layer: adjust one of the stubs for the NearbyManager API to resolve a remaining issue</li><li>Sandboxed Google Play compatibility layer: use per-network MAC randomization and enable send device name for wireless Android Auto networks to avoid introducing compatibility issues by default for certain cars with either our per-connection MAC randomization feature or default disabled DHCP device name</li><li>adjust hasSendDhcpHostnameEnabledChanged() based on new "Send device name" setting value to avoid introducing a permission issue</li><li>temporarily disable memory tagging for the Pixel Camera Services app until memory corruption bugs are resolved</li><li>extend one-time removal of leftover Vanadium library state to handle it for Alpha/Beta users who removed it from Owner themselves but still have it in other users</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101900">2024101900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101900">2024101900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101801 release:</p><ul><li>drop existing "Send device name" setting value for all Wi-Fi networks to start from our default of disabled for all users including people who updated to the Beta and Alpha releases already (we already switched the default to off for new networks in <a href="https://grapheneos.org/releases#2024101800">2024101800</a>)</li><li>limit removal of shared library updates as part of our system APK verified boot feature to those equal to the OS version since older versions are already dealt with and removing them this way leaves behind stale package state cluttering the UI</li><li>run a one-time task to remove leftover Vanadium library state to avoid showing a list of old versions</li><li>Settings: fix upstream Android 15 bug causing a crash for the network privacy menu when the AP name has special characters</li><li>Sandboxed Google Play compatibility layer: add stubs for NearbyManager API to avoid crashes from Find My Device feature</li><li>Dialer: fix new upstream crashes in Android 15 caused by R8 optimization</li><li>fix upstream Android 15 bug causing a Wallet quick tile provided by a user installed app to be automatically added, which isn't intended</li><li>fix upstream Android bug causing crash when showing app's first confirmation prompt for PackageInstaller</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101801">2024101801</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101801">2024101801</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101800 release:</p><ul><li>Sandboxed Google Play compatibility layer: only check for SET_BIOMETRIC_DIALOG_ADVANCED permission for GmsCompat apps to avoid causing crashes elsewhere</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101800">2024101800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101800">2024101800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101701 release:</p><ul><li>stop enabling the new Android 15 "Send device name" toggle for Wi-Fi networks by default to continue avoiding sending the device model (default) or user configured device name as a DHCP client hostname (Alpha channel testers on our previous Android 15 releases need to toggle it off for each existing network themselves if they don't want it)</li><li>Sandboxed Google Play compatibility layer: handle lack of SET_BIOMETRIC_DIALOG_ADVANCED permission</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101701">2024101701</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101701">2024101701</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101700 release:</p><ul><li>Sandboxed Google Play compatibility layer: declare C2DM SEND permission ourselves in addition to the already covered READ_GSERVICES and C2DM RECEIVE to avoid issues with Firebase Cloud Messaging for fresh installs of sandboxed Google Play without the Google Services Framework (GSF) app that's no longer a dependency in our App Store for Android 15</li><li>Settings: enable our per-connection Wi-Fi MAC randomization feature by default for new networks again on Android 15 instead of the standard per-network approach</li><li>Settings: extend change in the previous release for hiding inaccurate Private Space information</li><li>persist GrapheneOS-specific package state when archiving an app</li><li>Radio Info, Wi-Fi testing (Settings): opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bug)</li><li>stop excluding Gallery from Private Space</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101700">2024101700</a></h3><p>This is the second release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. It fixes nearly all of the reported regressions, but we have a couple more things to fix in another release later today before the release will be able to reach Beta and Stable.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101700">2024101700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101600 release:</p><ul><li>fix upstream Android 15 bug in InputMethodManagerService.resetDefaultImeLocked() causing system_server crash from null pointer exception</li><li>fix upstream Android 15 bug in KeyguardUpdateMonitor.onPostureChanged() causing SystemUI crash on foldable devices from null pointer exception due to GrapheneOS currently only having fingerprint unlock and not face unlock</li><li>Messaging: add new permissions needed on Android 15 (READ_CELL_BROADCASTS and RECEIVE_WAP_PUSH) which avoids it prompting to be set as the default app instead of completing certain actions requiring privileges it was missing</li><li>Settings: port our default enabled per-connection MAC randomization option to the new Compose-based UI in Android 15 so the default mode displays properly and it can be restored back to the default value</li><li>fix Android 15 port of our toggle for disabling granting our Sensors permission by default</li><li>Storage Manager, Emergency Info: opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bugs)</li><li>Sandboxed Google Play compatibility layer: replace GmsCompatConfig Bluetooth stubs with in-place checks for improved reliability and readability</li><li>ignore the standard stock OS configured Factory Reset Protection since installing GrapheneOS implies the ability to bypass it via the device being unlocked and if we added our own anti-theft system it would not use the same approach using Google account recovery</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release</li><li>Launcher: remove "Install in private" shortcut for now since the standard behavior of opening the app in the first party app store isn't currently useful on GrapheneOS right now and is confusing to users</li><li>Settings: hide inaccurate "access private space when hidden" text that's not currently relevant to GrapheneOS since AOSP doesn't have this launcher feature yet</li><li>Keyboard: remove launcher icon to avoid it temporarily showing up in new users/profiles (not a recent regression)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-142">version 142</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-143">version 143</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101600">2024101600</a></h3><p>This is the initial release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. We had previously ported all of our features to Android 15 based on the Beta releases and have been finishing it up based on the early September release of the source code for Android 15. Our initial port of all our features was completed on September 3rd and we've been polishing it up while we've been working on regular development.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101600">2024101600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101200 release:</p><ul><li>full 2024-10-05 security patch level since the Pixel patches were disclosed in the Pixel Update Bulletin today</li><li>rebased onto AP3A.241005.015 Android Open Source Project release (Android 15)</li><li>full port of GrapheneOS features to Android 15 including integration of our features with the new Android 15 features including Private Space</li><li>Sandboxed Google Play compatibility layer: add stubs to fully remove the need for the Google Services Framework (GSF) app for fresh installs of sandboxed Google Play, which has been removed as a dependency in our app repository for Android 15+, but it should still be kept for existing installs to avoid potential issues</li><li>Pixel 9 Pro Fold: add assorted device-specific Settings and SystemUI changes to better match the stock OS</li><li>disable Bluetooth auto-on feature by default</li><li>temporarily enable system crash notifications unconditionally for the initial release based on Android 15 release</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.56</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>Seedvault: minor changes to prepare for a complete fork and overhaul in the future</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.58.0">version 130.0.6723.58.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-141">version 141</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101200">2024101200</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200-redfin">2024101200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200">2024101200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200-caimito">2024101200-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024100800 release:</p><ul><li>hardened_malloc: preserve hardware memory tagging enforcement flag for slab mappings when releasing free slabs</li><li>hardened_malloc: improve accuracy of probability hint for hardware memory tagging branches</li><li>temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps</li><li>Log Viewer: add "bootloader unlocked" and "dev options enabled" flags to header</li><li>Log Viewer: add "More info" button to native crash reports</li><li>Log Viewer: include contents of App Not Responding (ANR) stack traces file in ANR error reports</li><li>Log Viewer: omit processUptime header line when it's unknown</li><li>Settings Intelligence (Settings search): fix upstream bug resulting in corruption of the query history database which leads to the search crashing</li><li>Launcher: mark 2x2 workspace option as being for phones</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.54</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.100.0">version 129.0.6668.100.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024100800">2024100800</a></h3><p>This is an early October security update release based on the October 2024 security patch backports since a monthly Android Open Source Project and stock Pixel OS release based on Android 14 QPR3 hasn't been published yet. Android 15 is scheduled for release around October 15th and they may not have a monthly release based on Android 14 QPR3 before then.</p><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800-redfin">2024100800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800">2024100800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800-caimito">2024100800-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024092900 release:</p><ul><li>full 2024-10-01 security patch level</li><li>overhaul the implementation of our USB-C port control feature to improve robustness and error reporting</li><li>fix an upstream Android Bluetooth use-after-free bug uncovered by GrapheneOS hardware memory tagging that's triggered when obtaining internet access from another device via Bluetooth</li><li>fix an upstream Android race condition bug in handling of system error files to avoid using the wrong timestamps for system errors and then reporting them as new errors after reboot</li><li>work around an upstream Android bug causing our Log Viewer feature to stop working after system_server restarts</li><li>add handling for early boot-time system journal notifications</li><li>kernel (5.10, 5.15, 6.1, 6.6): backport upstream patch fixing a hole in SELinux W^X enforcement</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.226</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.167</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.112</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.53</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.81.0">version 129.0.6668.81.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-140">version 140</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024092900">2024092900</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900-redfin">2024092900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900">2024092900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900-caimito">2024092900-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024091900 release:</p><ul><li>extend standard Android eBPF filter to prevent apps sending multicast packets outside of the VPN tunnel either directly or indirectly via kernel-generated multicast traffic (IGMP, MLD) when leak blocking is enabled (2nd generation implementation with improved app compatibility)</li><li>add netfilter-based multicast firewall only permitting sending multicast packets to permitted tunnel interfaces for the process to prevent apps sending multicast packets through a VPN tunnel for another profile (2nd generation implementation with improved IPv6 and app compatibility)</li><li>Sandboxed Google Play compatibility layer: add stub for Bluetooth AdvertisingSetParameters.setOwnAddressType() API needed for receiving files through Quick Share</li><li>Sandboxed Google Play compatibility layer: ignore GattServer in BTLeAdvertiser.startAdvertisingSet() needed for receiving files through Quick Share</li><li>Auditor: add battery optimization exception to avoid delays for the opt-in scheduled remote verification since users rarely interact with the app resulting in it being placed into semi-restricted standby buckets</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/86">version 86</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/26">version 26</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.70.0">version 129.0.6668.70.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-138">version 138</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-139">version 139</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024091900">2024091900</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900-redfin">2024091900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900">2024091900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900-caimito">2024091900-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024091700 release:</p><ul><li>temporarily revert multicast leak blocking firewall due to causing legacy 5th gen devices to lose compatibility with IPv6-only carriers along with causing certain compatibility issues with IPv6 on Wi-Fi</li><li>temporarily revert multicast leak blocking eBPF filter extensions until app compatibility is addressed in a similar way as the Network permission mimics non-security errors</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024091700">2024091700</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700-redfin">2024091700-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700">2024091700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700-caimito">2024091700-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024090400 release:</p><ul><li>Sandboxed Google Play compatibility layer: handle the updated client dynamite module initialization sequence</li><li>extend standard Android eBPF filter to prevent apps sending multicast packets outside of the VPN tunnel either directly or indirectly via kernel-generated multicast traffic (IGMP, MLD) when leak blocking is enabled</li><li>add netfilter-based multicast firewall only permitting sending multicast packets to permitted interfaces for the process to prevent apps sending multicast packets through a disallowed interface such as a VPN tunnel for another profile</li><li>exclude com.android.rkpdapp from backup/restore to avoid breaking key provisioning for hardware key attestation including for Auditor (users can clear RemoteProvisioner system app data via Settings if they restored data for it and have this issue)</li><li>Pixel 9 Fold Pro: temporarily manually add resource overlays not yet automatically handled by adevtool from the stock Pixel OS to use the correct layout for quick settings, status bar, etc. and to provide the split folded/unfolded auto-rotate settings (this will be replaced by adevtool improvements before the end of the month since we'll need it for more resources in Android 15)</li><li>hardened_malloc: fix microdroid virtual machine compatibility by using armv8a+dotprod+memtag when enabling memory tagging instead of armv9+memtag</li><li>init: disable auto-reboot setup for microdroid virtual machines</li><li>expat: backport patches for CVE-2024-28757, CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492 (none of these is exploitable on official GrapheneOS since the DoS bug involves a feature Android doesn't use, the integer overflows require that size_t is 32-bit which is never going to be the case due to the code only being used in 64-bit processes and the negative parameter API issue requires a usage pattern not done by Android, but the integer overflows would be exploitable on an official build for a 32-bit device or a 64-bit device still partially using 32-bit drivers)</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.225</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.165</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.104</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.51</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.127.0">version 128.0.6613.127.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.146.0">version 128.0.6613.146.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.54.0">version 129.0.6668.54.0</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/25">version 25</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/85">version 85</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/4">version 4</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-136">version 136</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-137">version 137</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024090400">2024090400</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400-redfin">2024090400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400">2024090400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400-caimito">2024090400-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024083100 release:</p><ul><li>full 2024-09-05 security patch level</li><li>rebased onto AP2A.240905.003 (generic) and AD1A.240905.004 (caimito) Android Open Source Project releases</li><li>Sandboxed Google Play compatibility layer: add support for using GSF 34 on SDK 35 (Android 15) to handle the case where users have just upgraded the OS but haven't yet updated GSF</li><li>Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix an upstream use-after-free bug present in 2 drivers</li><li>allow Pixel Thermometer and Fitbit to see each other as a special case</li><li>allow current launcher to see the Pixel Thermometer app as a special case</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.47</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-134">version 134</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-135">version 135</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024083100">2024083100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100-redfin">2024083100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100">2024083100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100-caimito">2024083100-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024082200 release:</p><ul><li>don't hide Exploit protection Safety Center item in secondary users</li><li>Settings: improve UI for GrapheneOS app toggles including adding a screen for viewing the values across apps for each toggle</li><li>add more infrastructure for blocking dynamic code loading</li><li>Settings: add per-app memory dynamic code loading restriction toggle (applies to both native code and Android Runtime class loading for Java/Kotlin)</li><li>Settings: add per-app storage dynamic code loading restriction toggle (applies to both native code and Android Runtime class loading for Java/Kotlin), temporarily without a global toggle until Google phases out the old dynamite module system for Google Play due to many apps temporarily depending on this through it</li><li>Settings: add per-app WebView JIT restriction toggle</li><li>add production support for the Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL and Pixel 9 Pro Fold</li><li>add support for enabling app association restrictions without exemptions (currently for use with Pixel Thermometer)</li><li>add support for Pixel Thermometer app available from our App Store for the Pixel 8 Pro, Pixel 9 Pro and Pixel 9 Pro XL with strict isolation from other apps</li><li>add missing feature compatibility matrix definitions (mainly for 9th generation Pixels)</li><li>Contact Scopes: explicitly set initialization order after ContactsProvider2 to avoid uncaught exceptions from a race</li><li>kernel (6.1): disable unused hibernation support</li><li>kernel (6.1, 6.6): enable struct randomization in the full mode with a deterministic seed based on kernel commit timestamp (we plan to also incorporate the device family and eventually make the seed specific to each device model, but it will increase our build/testing workload)</li><li>kernel (6.6): enable random kmalloc caches</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.96</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.46</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.88.1">version 128.0.6613.88.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.99.0">version 128.0.6613.99.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/84">version 84</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-131">version 131</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-132">version 132</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-133">version 133</a></li><li>drop restriction on modifying GrapheneOS-specific per-package settings via ADB shell since it makes certain important testing require debug builds and has no real security value</li><li>flash-all.sh: restore POSIX sh compatibility to allow using sh instead of bash on systems where sh is dash or another non-bash-compatible shell</li><li>add support for using backslashes in the passphrases for encrypting the keys for signing OS releases</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024082200">2024082200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082200-redfin">2024082200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082200">2024082200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024082000 release:</p><ul><li>Settings: fix regression in the previous release which blocked it reaching the Stable channel by making the duress PIN/password configuration unavailable in secondary users again (it was only usable when the secondary user had the same unlock PIN/password as the Owner user)</li><li>adevtool: remove non-functional repair mode support</li><li>adevtool: remove non-functional digital car key support (requires privileged Google Play)</li><li>adevtool: remove invalid clock font family overlay (google-sans-clock font not included)</li><li>adevtool: update carrier settings</li><li>Pixel 8a: add Let's Encrypt (ISRG) roots for Samsung gnssd SUPL connections via adevtool instead to share the implementation with 9th generation Pixels</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/83">version 83</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.88.0">version 128.0.6613.88.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024082000">2024082000</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082000-redfin">2024082000-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082000">2024082000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080600 release:</p><ul><li>Settings: enable Safety Center and port all of the relevant GrapheneOS settings to it both to provide the more modern user interface and to prepare for the release of Android 15</li><li>hide Safety Center camera extensions fallback toggle when it's not relevant (not used on Pixels)</li><li>Package Installer: fix upstream bug causing null pointer exception in rare edge cases including a rare race condition</li><li>require Owner user credential to check whether a duress PIN/password is enabled as hardening against potential UI bugs such as the upstream predictive back gesture issue we patched in the Settings app</li><li>apply upstream change for 6th generation Pixels making snapuserd available in recovery to avoid a problem in a rare edge case where a factory reset occurs before finishing booting a new update</li><li>apply minor upstream fixes for Settings which were temporarily only shipped for certain Pixels</li><li>add fastboot to otatools.zip for optimized factory images generation</li><li>flash-all: raise minimum fastboot version to 35.0.1</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.223</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.164</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.95</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.45</li><li>remove duplicate Android.bp from unpacked otatools.zip to avoid breaking subsequent builds when it's unpacked in the source tree</li><li>add Android 15 Beta build configuration for early development/testing of our Android 15 port via an ap2f release configuration enabling all of the available Android 15 feature flags</li><li>port GrapheneOS changes to new code for Android 15 used by our Android 15 Beta build configuration</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.0">version 127.0.6533.104.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.1">version 127.0.6533.104.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.2">version 127.0.6533.104.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.3">version 127.0.6533.104.3</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-128">version 128</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-129">version 129</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-130">version 130</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080600">2024080600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080600-redfin">2024080600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080600">2024080600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080500 release:</p><ul><li>full 2024-08-05 security patch level</li><li>rebased onto AP2A.240805.005 Android Open Source Project release</li><li>adevtool: update dependencies</li><li>adevtool: improve code quality</li><li>adevtool: use fastboot packs to extract firmware images to avoid the need to download over-the-air updates, which also removes the dependency on python and python-protobuf for extracting vendor files</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.103.0">version 127.0.6533.103.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/74">version 74</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080500">2024080500</a></h3><p>This is an early August security update release based on the August 2024 security patch backports. This month's release of the Android Open Source Project and stock Pixel OS should be available later today or tomorrow and we'll quickly release an update based on it following this one.</p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080500-redfin">2024080500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080500">2024080500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080200 release:</p><ul><li>full 2024-08-01 security patch level</li><li>suppress crash notifications for 2 harmless crashes occuring on service shutdown for the Android Bluetooth service and Pixel wifi_ext service</li><li>enable memory tagging for the Pixel wifi_ext service again</li><li>Settings: disable predictive back gesture in PIN/password input activities to fix an upstream Android vulnerability</li><li>flash-all: remove unnecessary sleep after flashing AVB key</li><li>flash-all: exit on errors</li><li>flash-all.sh: avoid false negative for device model check</li><li>flash-all.bat: pause before exiting after an error</li><li>fastboot: add support for CLI install with the GrapheneOS optimized factory images format already used by the web installer (will reduce memory/storage usage for CLI installs and will reduce storage usage on the update servers by avoiding multiple factory image formats)</li><li>hardened_malloc: update libdivide to 5.1</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.43</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080200">2024080200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080200-redfin">2024080200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080200">2024080200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080100 release:</p><ul><li>prevent VPN apps from having leaks to non-VPN DNS servers while not yet strictly preventing leaks to VPN DNS outside the VPN tunnel due to multiple VPN apps including Proton VPN not connecting reliably with stricter enforcement (in a future release, we can do strict blocking by default with an opt-out toggle and a list of known incompatible apps such as Proton VPN until the compatibility issue is resolved)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-126">version 126</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-127">version 127</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/73">version 73</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080100">2024080100</a></h3><p><strong>This release is only for the Alpha channel to replace the previous release.</strong></p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080100-redfin">2024080100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080100">2024080100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024073100 release:</p><ul><li>revert VPN DNS leak protection again since it's still partially incompatible with Proton VPN and certain other apps for unknown reasons, although we did avoid a lot of the compatibility issues from last time</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024073100">2024073100</a></h3><p><strong>This release was only pushed out to the Alpha channel.</strong></p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024073100-redfin">2024073100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024073100">2024073100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024072800 release:</p><ul><li>add back our change to prevent app-based VPN implementations from leaking DNS requests when the VPN is down/connecting but without enforcement for VPN apps without DNS configured to avoid breaking compatibility in rare cases (our previous implementation in <a href="https://grapheneos.org/releases#2024050900">2024050900</a> had to be reverted before it reached Stable)</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/72">version 72</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.84.0">version 127.0.6533.84.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024072800">2024072800</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024072800-redfin">2024072800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024072800">2024072800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024071600 release:</p><ul><li>avoid isolating eUICC LPA (eSIM activation) app from third party apps to allow carrier activation apps to work (we still block communication with Google Play to avoid sending telemetry data to Google services when sandboxed Google Play is installed)</li><li>Pixel 8a: fix GNSS configuration to avoid occasional crashes of the service (Pixel 8a is currently the only Samsung GNSS device)</li><li>Settings: don't allow disabling user installed apps when uninstall is disallowed</li><li>Settings: drop code for supporting the legacy Settings UI</li><li>Sandboxed Google Play compatibility layer: avoid infinite wait for GmsCompatConfig update when call to App Store fails</li><li>enforce stack clash protection for x86_64</li><li>enforce minimum 64kiB stack guard size for arm64 due to the standard stack probe size of 64kiB</li><li>future proof our Bionic libc changes for dynamic 64k pages (hardened_malloc still doesn't support it)</li><li>flash-all: remove unnecessary reboot after flashing Android Verified Boot (AVB) key</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.222</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.163</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.92</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.42</li><li>adevtool: update to latest carrier settings</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/24">version 24</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/69">version 69</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/70">version 70</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/71">version 71</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/81">version 81</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/82">version 82</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.64.0">version 127.0.6533.64.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.64.1">version 127.0.6533.64.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-124">version 124</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-125">version 125</a></li><li>fastboot: add support for generating web installer optimized factory images zip for an improved web install approach not requiring fastbootd</li><li>integrate generating web installation optimized factory images zip into release signing script</li><li>split script/release.sh to remove dependency on build output and the OS source tree (see the new instructions for signing releases)</li><li>rename script/release.sh to script/generate-release.sh</li><li>add script/generate-releases.sh wrapper script</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024071600">2024071600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071600-redfin">2024071600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071600">2024071600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024071200 release:</p><ul><li>fix touch-to-unlock setting on devices with a power button fingerprint scanner (Pixel Fold, Pixel Tablet) which is normally always active with AOSP</li><li>avoid race for setting USB port mode when the lock method is set to none (lockscreen disabled)</li><li>Pixel Tablet: add non-standard toggle for enabling touchscreen frequency hopping to reduce ghost touches for users with problematic touchscreen hardware</li><li>kernel (5.10, 5.15): revert a USB change backported to kernel.org LTS that's causing DisplayPort alternate mode compatibility issues</li><li>Pixel 8a: fix GNSS configuration to avoid occasional crashes of the service (Pixel 8a is currently the only Samsung GNSS device)</li><li>backport mainline APEX module patches for Media Provider, Network Stack, Remote Key Provisioning and Wi-Fi</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.221</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.161</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-123">version 123</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024071200">2024071200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071200-redfin">2024071200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071200">2024071200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070900 release:</p><ul><li>kernel (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a): temporarily revert disabling 32-bit ABI support due to rare cases of apps using a buggy anti-tampering library incorrectly calling 32-bit versions of system calls from 64-bit code even on devices with no 32-bit support in hardware</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.160</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.38</li><li>TalkBack (screen reader): update dependencies</li><li>TalkBack (screen reader): remove more unused resources</li><li>TalkBack (screen reader): drop 32-bit OS support</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070900">2024070900</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070900-redfin">2024070900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070900">2024070900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070201 release:</p><ul><li>Settings: extend standard fingerprint enrollment stages with proper support for devices with power button fingerprint scanners (Pixel Fold, Pixel Tablet) which is not present in AOSP (Pixel Fold was still usable, but it had become incredibly hard to successfully register new fingerprints on the Pixel Tablet)</li><li>improve warning for 32-bit-only apps by explaining why the warning is shown, how to resolve it for apps that are still developed and that we plan to phase out support for it on 5th/6th generation Pixels where it's still available</li><li>show warning for 32-bit-only apps on each launch instead of only once</li><li>kernel (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a): disable 32-bit ABI support to substantially decrease kernel size and attack surface and raise mmap_min_addr to the standard 65536 for 64-bit-only ARM</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.158</li><li>adevtool: update file removal for 8th gen Pixels to skip Family Space related files</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-122">version 122</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.3">version 126.0.6478.122.3</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070201">2024070201</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070201">2024070201</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070200 release:</p><ul><li>full 2024-07-05 security patch level</li><li>rebased onto AP2A.240705.005 Android Open Source Project release</li><li>avoid skipping toggling USB port after unlock in certain edge cases to make sure devices connected while locked are always detected when unlocking</li><li>fix upstream bug causing first party app stores using the package install dialog to be blocked when the user isn't allowed to install apps from third party sources</li><li>fix notification suppression check in currently unused code to prepare for our per-app clipboard toggle</li><li>adevtool: download and use latest Pixel carrier settings from the API for use by our CarrierConfig2 app instead of using the snapshot included in the latest Pixel stock OS release since it lags months behind</li><li>Settings: fully fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy</li><li>Sandboxed Google Play compatibility layer: stub out reads of hidden system settings in Google's speech services app to avoid uncaught security exceptions</li><li>Sandboxed Google Play compatibility layer: don't allow the Play Store to abort pending package installation to avoid it cancelling install/update attempts after 10 minutes of waiting for requested user approval it hasn't been designed to handle</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.218</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.155</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.36</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070200">2024070200</a></h3><p>This is an early July security update release based on the July 2024 security patch backports. This month's release of the Android Open Source Project and stock Pixel OS will be available later today and we'll quickly release an update based on it following this one.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070200">2024070200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024062700 release:</p><ul><li>full 2024-07-01 security patch level</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.1">version 126.0.6478.122.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.2">version 126.0.6478.122.2</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/3">version 3</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-121">version 121</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024062700">2024062700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024062700">2024062700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024062000 release:</p><ul><li>add new GrapheneOS Info app through which you can get information about the latest releases of GrapheneOS, links to our community spaces, and details on how to make donations</li><li>Pixel 8a: add Let's Encrypt roots to Samsung gnssd CA root store for supl.grapheneos.org</li><li>Pixel 8a: configure Samsung gnssd to use TLSv1.2 for SUPL instead of TLSv1.1 (TLSv1.3 would work but the config doesn't offer it)</li><li>Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold: fully remove 32-bit ARM support to significantly reduce build time and update download size with no loss of functionality (7th gen Pixels launched with 32-bit app support disabled after several years of the Play Store blocking uploading 32-bit-only apps or installing them on 64-bit devices, and 8th gen Pixels use 2nd gen ARMv9 cores with no 32-bit support)</li><li>Settings: fix several cases of UI state being lost when resuming activity after configuration changes, etc. for GrapheneOS settings</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.216</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.90</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.35</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.0">version 126.0.6478.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-120">version 120</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024062000">2024062000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024062000">2024062000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061400 release:</p><ul><li>remove our USB peripheral security setting on devices supporting our much better USB-C port mode (Pixel 6 and later)</li><li>extend USB-C port setting to also handle pogo pins on the Pixel Tablet</li><li>kernel (5.10, 5.15, 6.1, 6.6): replace our deny_new_usb feature with a new deny_new_usb2 feature also disabling USB gadgets</li><li>extend USB-C port setting to enable deny_new_usb2 as a second layer of defense disabling new USB connections in the kernel (the existing implementation disables new connections and USB data at a hardware level via the USB controller, which disables more attack surface, but we want to keep around the higher level kernel approach too)</li><li>Files: fix upstream null pointer exception triggered on resuming activity</li><li>Settings: require user authentication for changing auto-reboot, USB peripheral and USB-C port security settings</li><li>Settings: avoid prompting for user authentication when selecting the same value as before for GrapheneOS settings requiring it</li><li>temporarily add back memory tagging exception for Pixel wifi_ext service</li><li>simplify implementation of our auto-reboot feature and properly handle the first lock after the user first sets up a lock method</li><li>avoid resetting USB-C port after first unlock if it was already connected Before First Unlock (fix for regression caused by upstream changes)</li><li>add GrapheneOS Linux kernel port to the 6.6 GKI LTS branch</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.215</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.87</li><li>kernel (6.1, 6.6): add script for building emulator kernel</li><li>kernel (6.1, 6.6): enable forced module signing for x86_64 (emulator builds)</li><li>System Updater: increase update check interval to 6 hours from 4 hours</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.110.0">version 126.0.6478.110.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-118">version 118</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-119">version 119</a></li><li>fix cast in GrapheneOS package management infrastructure needed for upcoming App Communication Scopes work</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061400">2024061400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061400">2024061400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061300 release:</p><ul><li>revert upstream refactoring of the device association code in Android 14 QPR3 due to it introducing a chain crash bug at boot in edge cases with associated devices such as paired Android Wear devices</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.71.0">version 126.0.6478.71.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061300">2024061300</a></h3><p>We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha and Beta testing.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061300">2024061300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061200 release:</p><ul><li>fix upstream Android 14 QPR3 regression which breaks updating certain apps with our app repository client</li><li>fix boot-time optimizing apps progress UI with Android 14 QPR3 and enable it again</li><li>fix regression in our Android 14 QPR3 port resulting in PIN scrambling in secondary users being determined by the Owner user setting</li><li>revert upstream Android 14 QPR3 Internet quick tile overhaul since it broke the functionality in secondary users</li><li>temporarily add back disabling memory tagging and hardened_malloc for surfaceflinger since Android 14 QPR3 didn't fix it as expected</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release</li><li>add additional null check for eSIM wiping done as part of the duress PIN/password wipe implementation to avoid harmless exception</li><li>Settings: remove blank illustration from "Screen resolution" screen</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.1">version 126.0.6478.50.1</a></li><li>make duress PIN/password tests faster and more reliable</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061200">2024061200</a></h3><p>This is the first release of GrapheneOS based on Android 14 QPR3, the 3rd quarterly maintenance/feature release for Android 14.</p><p>We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha testing.</p><p>Pixel 8a is now supported as part of the standard Android releases instead of having a device branch based on Android 14 QPR1. We've had stable releases for it available since May 15th (1 day after launch) based on our last QPR1-based release (2024030300). Pixel 8a users will be getting the GrapheneOS improvements from March, April, May and June along with the Android 14 QPR2 and QPR3 improvements so it's a much larger release for the Pixel 8a.</p><p>Since Android 14 QPR3 is a major release, the end-of-life Pixel 4a (5G) and Pixel 5 receiving extended support releases from GrapheneOS will need to be ported to it with additional work in a future release, which is done as a low priority. Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061200">2024061200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024060500 release:</p><ul><li>full 2024-06-05 security patch level</li><li>rebased onto AP2A.240605.024 Android Open Source Project release, which is the 3rd quarterly maintenance/feature release for Android 14 (QPR3)</li><li>temporarily disable boot-time optimizing apps progress UI due to upstream Android 14 QPR3 regression (our own post-boot background optimizing apps progress notification works fine)</li><li>temporarily enable system crash notifications unconditionally for the initial QPR3-based release</li><li>change default USB-C port mode to "Charging-only when locked" from "Charging-only when locked, except before first unlock"</li><li>stop disabling memory tagging and hardened_malloc for surfaceflinger</li><li>Settings: fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.0">version 126.0.6478.50.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-117">version 117</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024060500">2024060500</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060500-redfin">2024060500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060500">2024060500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024060400 release:</p><ul><li>Sandboxed Google Play compatibility layer: adjust to DynamiteLoader changes being deployed with a new feature flag in Play services 24.22</li><li>stop treating pressing the spacebar on a physical keyboard as submitting the lockscreen password since it prevents entering passphrases with spaces (upstream Android bug which has existed for around 8.5 years)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.165.0">version 125.0.6422.165.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-116">version 116</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024060400">2024060400</a></h3><p>This is an early June security update release based on the June 2024 security patch backports since this month's release of the Android Open Source Project and stock Pixel OS with Android 14 QPR3 isn't available yet.</p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060400-redfin">2024060400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060400">2024060400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024053100 release:</p><ul><li>full 2024-06-01 security patch level</li><li>extend the standard wipe-without-reboot implementation beyond wiping the hardware keystores (which prevents recovering any OS data by preventing deriving the key encryption keys) by also wiping the secdiscardable data on the SSD needed to derive key encryption keys, the encrypted storage keys on the SSD and the Weaver slots in the secure element needed to derive per-user key encryption keys via a secure element erase</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024053100">2024053100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024053100-redfin">2024053100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024053100">2024053100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024052100 release:</p><ul><li>add support for setting a duress password and PIN for quickly wiping all hardware keystore keys including keys used as part of deriving the key encryption keys for disk encryption to make all OS data unrecoverable followed by wiping eSIMs and then shutting down</li><li>disable unused adoptable storage support since it would complicate duress password feature (can be added if we ever support a device able to use it)</li><li>increase default max password length to 128 to improve support for strong diceware passphrases, which will become more practical for people who don't want biometric-only secondary unlock with our upcoming 2-factor fingerprint unlock feature</li><li>disable camera lockscreen shortcut functionality when camera access while locked is disabled to avoid the possibility of misconfiguration by adding the camera lockscreen shortcut and then forgetting to remove it when disabling camera access</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.153</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.72.0">version 125.0.6422.72.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.72.1">version 125.0.6422.72.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.113.0">version 125.0.6422.113.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.147.0">version 125.0.6422.147.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-112">version 112</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-113">version 113</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-114">version 114</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-115">version 115</a></li><li>make SystemUI tests compatible with GrapheneOS changes</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024052100">2024052100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024052100-redfin">2024052100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024052100">2024052100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024051500 release:</p><ul><li>add backport of the upstream Android implementation of wipe-without-reboot, which is the full fix for the ability to interrupt factory resets triggered by device admin apps (CVE-2024-29748 reported by GrapheneOS) and provides the infrastructure needed for our upcoming duress PIN/password feature in a much simpler way via existing HAL APIs</li><li>temporarily disable memory tagging for the Pixel camera provider and wifi_ext services due to incompatibilities found by users which should be addressed in an upcoming release of AOSP and the stock Pixel OS</li><li>Pixel 4a (5G), Pixel 5: omit Pixel Camera Services since it doesn't provide useful functionality and is broken due to these devices not being supported anymore by the current releases</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.214</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.152</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.84</li><li>Setup Wizard: fix typo in data restore description</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-111">version 111</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024051500">2024051500</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024051500-redfin">2024051500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024051500">2024051500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024050900 release:</p><ul><li>revert our initial approach to blocking DNS leaks with third party Android VPN apps since it changed the behavior in a slightly different way than intended and caused compatibility issues with certain apps (particularly Proton VPN) which blocked us from releasing 2024050900 to the Stable channel (will be replaced in the near future with another approach)</li><li>improve GrapheneOS Predicted Satellite Data Service (PSDS) infrastructure with better logging, cleaner code and more generic code to support Samsung PSDS for the Pixel 8a in addition to Qualcomm and Broadcom PSDS</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/80">version 80</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-110">version 110</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.51.0">version 125.0.6422.51.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.53.0">version 125.0.6422.53.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024050900">2024050900</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024050900-redfin">2024050900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024050900">2024050900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024050700 release:</p><ul><li>prevent app-based VPN implementations from leaking DNS requests when the VPN is down/connecting (this is a preliminary defense against this issue and more research is required, along with apps preventing the leaks on their end or they'll still have leaks outside of GrapheneOS)</li><li>exclude Settings app from visible Location indicator too since it gets triggered from accessing Wi-Fi data when enabling Wi-Fi hotspot and potentially other info tied to Wi-Fi and Bluetooth</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.35.0">version 125.0.6422.35.0</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/19">version 19</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024050700">2024050700</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024050700-redfin">2024050700-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024050700">2024050700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024050300 release:</p><ul><li>full 2024-05-05 security patch level</li><li>rebased onto AP1A.240505.005 Android Open Source Project release</li><li>update our backports of mainline APEX Health Fitness patches</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.213</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.151</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.159.0">version 124.0.6367.159.0</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/18">version 18</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024050300">2024050300</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024050300-redfin">2024050300-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024050300">2024050300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024042200 release:</p><ul><li>remove special handling of the resolver activity ("Open with..." dialog) which was added to Android in order to support instant apps as preparation for our in-development App Communication Scopes feature</li><li>fix Google Fi eSIM activation</li><li>improve isolation of the eSIM activation apps</li><li>improve GrapheneOS infrastructure for per-app state</li><li>enable heap memory tagging for vendor processes by default, remove the user-facing toggle in the Settings and restrict toggling the value to debug builds</li><li>disable most handling for instant apps in the package manager as attack surface reduction</li><li>disable out-of-band APEX updates as attack surface reduction</li><li>only allow first party app source and shell to update system packages</li><li>improve robustness of original-package handling</li><li>Settings: hide GNSS SUPL and PSDS settings on devices without GNSS hardware</li><li>fix regression from our Android 14 QPR2 port causing Storage/Contact Scopes link to disappear after going back to the permissions screen</li><li>improve setup wizard theme to more closely match the stock Pixel OS configuration</li><li>backport mainline APEX module patches for Android Health, Media Provider, Network Stack, and Wi-Fi</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.212</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.150</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.80</li><li>Log Viewer: use human readable UTC time for logcat timestamps</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-105">version 105</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-106">version 106</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-107">version 107</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-108">version 108</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-109">version 109</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.82.0">version 124.0.6367.82.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.82.1">version 124.0.6367.82.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.82.2">version 124.0.6367.82.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.113.0">version 124.0.6367.113.0</a></li><li>Apps: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/23">version 23</a></li><li>work around our app repository client taking ownership of updates for the debug toggle we use to test new Android Auto releases</li><li>fix debug build option for testing same versionCode package updates</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024042200">2024042200</a></h3><p>This release is only being done for the Pixel 8 and Pixel 8 Pro due to lack of changes relevant to other devices.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024042200">2024042200</a> (Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024042100 release:</p><ul><li>kernel (5.15): revert another broken f2fs change from the 5.15.149 release (entirely separate from what was fixed in our last release)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024042100">2024042100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024042100-redfin">2024042100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024042100">2024042100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024042000 release:</p><ul><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): backport upstream f2fs patch for a kernel panic caused by another upstream f2fs patch included in the last GKI LTS update (this fix is not included in any Linux stable release yet but rather only the release candidates for Linux 6.9)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.78</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024042000">2024042000</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024042000-redfin">2024042000-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024042000">2024042000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024040900 release:</p><ul><li>for devices with hardware memory tagging support, add a toggle in Settings &gt; Security for opting into memory tagging in vendor processes currently excluded from it with the end goal of having it force enabled without a toggle as we do for the rest of the base OS</li><li>allow eSIM activation app to interact with Google Fi app when installed to fix Google Fi activation</li><li>use ro.vendor.build.svn system property from adevtool instead of AOSP to make sure it always matches the stock OS</li><li>Pixel Fold: update to AP1A.240405.002.A2 vendor files</li><li>Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel 8, Pixel 8 Pro: update to AP1A.240405.002.B1 vendor files</li><li>Log Viewer: include kernel log buffer in default log output</li><li>Log Viewer: show "Save" instead of "Copy" button for logs that are over ~50 KB</li><li>Log Viewer: improve handling of log saving</li><li>backport mainline APEX module patches for Android Health, ART, DNS Resolver, Media Provider, Network Stack, PermissionController and Wi-Fi</li><li>TalkBack (screen reader): update base code to 14.1 and massively overhaul our changes to it</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.149</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.76</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/123.0.6312.118.0">version 123.0.6312.118.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.42.0">version 124.0.6367.42.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/124.0.6367.54.0">version 124.0.6367.54.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/67">version 67</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/68">version 68</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/79">version 79</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-103">version 103</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-104">version 104</a></li><li>Setup Wizard: layout and style improvements</li><li>Setup Wizard: add functionality for testing on debug builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024040900">2024040900</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024040900-redfin">2024040900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024040900">2024040900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024040300 release:</p><ul><li>rebased onto AP1A.240405.002.A1 Android Open Source Project release (includes a launcher taskbar improvement)</li><li>avoid crashes in Chromium-based web browsers and the WebView in their sandboxed processes caused by an incompatibility between exec-based spawning and the new userfaultfd-based garbage collector enabled by Android 14 QPR2</li><li>DNS resolver: fix upstream bug resulting in NUL byte being included in the random string for the DNS-over-TLS test query</li><li>allow privileged installers to use getSharedLibraries(MATCH_ANY_USER) in order to enable Apps to handle an edge case involving shared libraries (Vanadium Trichrome library) updated in other users while avoiding adding the INTERACT_ACROSS_USERS permission used for this purpose by the Play Store</li><li>kernel (5.10, 6.1): update to latest GKI LTS branch revision</li><li>kernel (5.10): reapply reverted upstream f2fs and irq changes now that the regressions are resolved</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-102">version 102</a></li><li>fix our infrastructure for testing our CarrierConfig2 app</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024040300">2024040300</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024040300-redfin">2024040300-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024040300">2024040300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024040200 release:</p><ul><li>full 2024-04-05 security patch level</li><li>rebased onto AP1A.240405.002 Android Open Source Project release</li><li>fix upstream OS limitation preventing using emergency dialer from setup wizard in secondary users</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/123.0.6312.99.0">version 123.0.6312.99.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024040200">2024040200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024040200-redfin">2024040200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024040200">2024040200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024032100 release:</p><ul><li>full 2024-04-01 security patch level (early release based on AOSP 14 April security backports since the official April AOSP and stock Pixel OS monthly releases aren't available yet)</li><li>fix race condition for Wi-Fi and Bluetooth auto-turn-off leading to the first auto-turn-off timer after the first Wi-Fi or Bluetooth state update potentially not being scheduled</li><li>fix Wi-Fi auto-turn-off no longer handling Wi-Fi state change events not involving a Wi-Fi network</li><li>DocumentsUI (Files): do not delegate handling of downloaded APKs to DownloadProvider to avoid confusing install permission prompt</li><li>flash-all: raise minimum fastboot version to 34.0.5</li><li>kernel (Pixel 8, Pixel 8 Pro): sign vendor modules after building them instead of only signing generic (GKI) modules</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>fix upstream bug breaking pressing power button 5 times to make an emergency call</li><li>fix upstream bug causing 5 second delay to start the emergency dialer for the first time</li><li>CarrierConfig2 (app created by GrapheneOS to replace Google CarrierSettings): add stub implementation of VendorConfigProvider</li><li>Setup Wizard: use new API for emergency calls</li><li>Setup Wizard: add prompt for unlocked bootloader triggering reboot to fastboot mode to lock</li><li>Setup Wizard: add prompt for disabling OEM unlocking after the device is locked (will be disabled by default)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-100">version 100</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-101">version 101</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/123.0.6312.80.0">version 123.0.6312.80.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/123.0.6312.80.1">version 123.0.6312.80.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024032100">2024032100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024032100-redfin">2024032100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024032100">2024032100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024031400 release:</p><ul><li>Bluetooth: revert broken upstream change and changes depending on it to fix Galaxy Watch 6 Classic and likely other devices impacted by the same issue (this was a failure of upstream testing and release engineering for AOSP and doesn't impact the stock Pixel OS because it uses a different APEX module revision branched from an older revision of AOSP but it will impact every other Android-based OS on Android 14 QPR2 since there isn't a Bluetooth mainline module published in the Play Store and AOSP yet)</li><li>revert disabling hardened_malloc for Broadcom Bluetooth HAL (we've fixed the upstream issue and this wasn't needed)</li><li>revert allowing users to disable hardened_malloc for Bluetooth system app (we've fixed the upstream issue and this wasn't needed)</li><li>Android Runtime: disable stripping symbols for libart to restore compatibility with some popular obfuscated Chinese apps using a specific obfuscation SDK depending on private APIs which was broken by Android 14 QPR2 when not using the mainline ART module based on older code like the stock Pixel OS (does not result in any lost storage space, just slightly larger factory images / updates as if we'd bundled another small app)</li><li>Android Runtime: remove Android's hard-wired <code>speed-profile</code> compilation for launcher apps which was limiting ahead-of-time compilation for user installed launcher apps to the parts of the code included in baseline and/or cloud profiles rather than compiling the whole app via our default <code>speed</code> compilation which we use to replace JIT compilation and JIT profiles guiding background AOT compilation</li><li>backport 12 upstream fixes from the mainline MediaProvider, Wifi, NetworkStack and HealthFitness APEX modules</li><li>allow using device controls quick tile when unlocked since it already has a toggle for controlling availability so our new default requirement of the device being unlocked needs to be overridden for it</li><li>more complete setup design configuration to improve appearance of Setup Wizard, etc.</li><li>Settings: fix upstream footer formatting issue for App pinning screen</li><li>update timezone module to Android mainline 341510010 (based on tzdata 2024a)</li><li>kernel (5.15, 6.1): improve support for hosting servers by enabling SYN cookies as we do for the older kernels</li><li>kernel (6.1): drop obsolete usage of YAMA which we replaced with our dynamic SELinux flag extension</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-99">version 99</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024031400">2024031400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024031400">2024031400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024031100 release:</p><ul><li>allow users to disable GrapheneOS hardened_malloc for the Bluetooth system app via the Settings app to help with debugging upstream bugs (still enabled by default)</li><li>temporarily disable hardened_malloc for Broadcom Bluetooth HAL as a potential workaround for upstream bugs in Android 14 QPR2 (will be reverted if it doesn't help and reverted after fixes are implemented if it does help)</li><li>fix upstream bug in Android 14 QPR2 breaking Wi-Fi tethering on fresh installs before Wi-Fi is enabled for the first time, which didn't occur on the stock OS in practice due to it enabling Wi-Fi by default</li><li>fix upstream system_server crash in Android 14 QPR2 when installing updates to packages with an original-package application id such as Vanadium (was reported by users helping with Vanadium Alpha channel testing and we released Apps version 22 with a workaround avoiding the crash prior to this fix)</li><li>Apps: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/22">version 22</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/122.0.6261.119.0">version 122.0.6261.119.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/123.0.6312.40.0">version 123.0.6312.40.0</a></li><li>drop legacy script/envsetup.sh (see current build instructions)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024031100">2024031100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024031100">2024031100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024030900 release:</p><ul><li>toggle USB port after device unlock to automatically detect a device plugged in while it was in charging-only mode while locked, etc.</li><li>Tensor Pixels: change default mode for our USB-C port control feature able to truly disable USB at a hardware level to "Charging-only when locked, except before first unlock" (doesn't apply to connections that were made before locking or first unlock) which can be changed by users in Settings &gt; Security &gt; USB-C port</li><li>fix Wi-Fi auto-turn-off issues leading to it not triggering in certain cases caused by backwards incompatible changes in Android 14 QPR2</li><li>Pixel 8, Pixel 8 Pro: fix enabling DisplayPort alternate mode support</li><li>Pixel 8, Pixel 8 Pro: fully enable PAC and BTI for userspace too, especially since ShadowCallStack is not currently used in userspace and Clang type-based CFI is only used for a large subset of the important userspace code</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-98">version 98</a></li><li>improve internal infrastructure used by GrapheneOS features</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024030900">2024030900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024030900">2024030900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024030800 release:</p><ul><li>fix upstream Android 14 QPR2 use-after-free bug impacting Bluetooth LE audio with certain devices (reliably caught by our hardware memory tagging integration on the Pixel 8 and Pixel 8 Pro, but also impacts previous devices which still have the standard hardened_malloc mitigations for use-after-free)</li><li>Settings: hide placeholder dates for Battery information screen in Settings &gt; About device due to 6th/7th generation Pixel batteries having a placeholder value for the first use date</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024030800">2024030800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024030800">2024030800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024030700 release:</p><ul><li>add back unlocking requirement for the new Internet quick tile in QPR2</li><li>ThemePicker: restore themed icon and grid settings for QPR2 port</li><li>DocumentsUI (Files): work around crashes caused by QPR2 R8 changes resulting in code used via reflection being removed</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024030700">2024030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024030700">2024030700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024030600 release:</p><ul><li>Pixel 6, Pixel 6 Pro, Pixel 6a: fix USB-C mode control issue introduced by QPR2 port which prevented pushing out the last release</li><li>Gallery: work around crashes caused by QPR2 R8 changes resulting in code used via reflection being removed</li><li>Settings: enable Battery information screen in Settings &gt; About device for QPR2 including Manufacture date, Date of first use and Cycle count</li><li>Settings: make the style for settings consistent between Compose and non-Compose settings</li><li>fixes for certain GrapheneOS notifications in QPR2</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024030600">2024030600</a></h3><p>This is the first release of GrapheneOS based on Android 14 QPR2. Android 14 QPR2 is the first Android release following the new development model where quarterly releases follow the development branch. This release is a massive overhaul of the OS almost as large as the migration from Android 13 QPR3 to Android 14 despite fewer user facing changes. This release includes a large part of the migration to Android 15. The new development model will be very beneficial for GrapheneOS by spreading out the porting process throughout the year between major releases as part of the 3 quarterly releases between the yearly major releases.</p><p>Since this is a major release, the Pixel 4a (5G) and Pixel 5 have not been ported to Android 14 QPR2 as part our initial release. We need to determine whether it makes sense to move these end-of-life devices to Android 14 QPR2 or keep them on a legacy extended support release branch based on the last Android 14 QPR1 release.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024030600">2024030600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024030300 release:</p><ul><li>full 2024-03-05 security patch level</li><li>rebased onto AP1A.240305.019.A1 Android Open Source Project release, which is the 2nd quarterly maintenance/feature release for Android 14 (QPR2)</li><li>continue to allow disabling cell broadcast extreme alerts with all carriers contrary to QPR2 change</li><li>Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a: add back launcher app pinning to potentially work around launcher bugs</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/122.0.6261.105.0">version 122.0.6261.105.0</a></li><li>Pixel 6 Pro: remove unnecessary product name, model and brand overrides for attestation since we use the official ones</li><li>System Updater: fix typo in error message</li><li>System Updater: update summary for check for updates button now that it always checks immediately</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024030300">2024030300</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024030300-redfin">2024030300-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024030300">2024030300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024022800 release:</p><ul><li>System Updater: ignore configured constraints for user-initiated update checks</li><li>System Updater: avoid automatic retry for user-initiated update checks</li><li>Settings: migrate to new Compose-based Settings infrastructure in preparation for Android 14 QPR2</li><li>improve GrapheneOS infrastructure for per-app notifications</li><li>Setup Wizard: improve wording for secondary user setup word</li><li>adevtool: fix overlay parsing issues</li><li>adevtool: include missing "Learn more" fingerprint setup text</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-97">version 97</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024022800">2024022800</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024022800-redfin">2024022800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024022800">2024022800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024022600 release:</p><ul><li>Tensor Pixels: fix issue with the USB-C changes breaking recovery sideloading and the fastbootd flashing mode used by the web installer which blocked us being able to release the previous release to all users</li><li>Settings: change "Charging only" to "Charging-only" for the USB-C port mode options to make the meaning clearer</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/122.0.6261.90.0">version 122.0.6261.90.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024022600">2024022600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024022600-redfin">2024022600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024022600">2024022600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024022300 release:</p><ul><li>Tensor Pixels: add new USB-C port mode setting to Settings &gt; Security providing a high level of control over USB functionality with hardware-specific integration for disabling USB controller functionality including fully disabling the data lines. There are 5 modes: On (current default during testing), Charging-only when locked except before first unlock (likely near future default), Charging-only when locked, Charging-only and Off (which even disables charging while booted into the normal OS mode). The modes tied to lock state permit already connected devices to continue working after locking and disable the data lines at a USB controller level after disconnecting. This is much different from the existing USB features including the Android 12 USB HAL toggle which only disable high-level kernel functionality and leave all the low-level kernel driver, USB protocol and USB controller attack surface enabled.</li><li>kernel (5.10, 5.15): add support for ignoring USB alt modes</li><li>kernel (Tensor Pixels): extend max77759 USB-C controller driver used by Tensor Pixels with support for a sysfs node providing fine-grained control over the USB-C data path at the USB controller level</li><li>Setup Wizard: fix crash for SIM locales not recognized by com.android.internal.app.LocalePicker</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024022300">2024022300</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024022300-redfin">2024022300-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024022300">2024022300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024020500 release:</p><ul><li>completely new GrapheneOS Setup Wizard implementation for the initial setup of the device and secondary user profiles</li><li>Theme Picker: update color schemes including adding the monochromatic colorscheme option</li><li>Sandboxed Google Play compatibility layer: always apply PhenotypeFlag overrides to avoid regressions for some users</li><li>Sandboxed Google Play compatibility layer: catch SecurityException from setApplicationEnabledSetting() instead of relying on PhenotypeFlag override</li><li>Sandboxed Google Play compatibility layer: add support for Android Auto 11.3 by extending the wireless Android Auto and phone call handling toggles to also allow BluetoothAdapter#getActiveDevices</li><li>Sandboxed Google Play compatibility layer: add developer functionality for updating Android Auto via the Play Store for testing</li><li>Storage Scopes: avoid legacy apps using legacy storage crashing when trying to access the wallpaper</li><li>remove legacy AOSP Search app now that Vanadium provides the global search intent in addition to the more common web search intent also implemented by other browsers including Brave</li><li>fix upstream bug breaking package manager support for uninstalling apps only installed in other profiles from the Owner user</li><li>Settings: improve strings for network connection toggles</li><li>kernel (5.10, 5.15, 6.1): temporarily ignore sysrq_always_enabled to avoid sysrq being enabled on devices passing it on the kernel line unconditionally</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.75</li><li>Pixel 4a (5G), Pixel 5: update to UP1A.231105.001.B2 vendor files</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.164.0">version 121.0.6167.164.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.178.0">version 121.0.6167.178.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/122.0.6261.43.0">version 122.0.6261.43.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/122.0.6261.43.1">version 122.0.6261.43.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/122.0.6261.64.0">version 122.0.6261.64.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-94">version 94</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-95">version 95</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-96">version 96</a></li><li>only use build number for build display id to simplify the value shown at Settings &gt; About device &gt; Build number</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024020500">2024020500</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024020500-redfin">2024020500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024020500">2024020500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024012600 release:</p><ul><li>full 2024-02-01 security patch level</li><li>full 2024-02-05 security patch level</li><li>rebased onto UQ1A.240205.004 Android Open Source Project release</li><li>run full compacting garbage collection purging all regular Java heaps of dead objects in SystemUI and system_server after locking (this is already done after unlocking to purge data tied to the lock method and derived data, but it makes sense to do it after locking too)</li><li>kernel (Pixel 4a (5G), Pixel 5, Pixel 5a): update to latest Android 14 QPR2 Beta release including additional security fixes</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.209</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.148</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15, Generic 6.1): enable both software Shadow Call Stack (SCS) and Pointer Authentication Code (PAC) protection for kernel return addresses instead of only using SCS when PAC is unavailable</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15, Generic 6.1): enable Branch Target Identification (BTI) protection for the kernel in addition to Clang type-based CFI to provide coarse-grained CFI coverage for indirect calls excluded from type-based CFI</li><li>kernel (Generic 6.1): apply sysrq hardening changes</li><li>kernel (Generic 6.1): update to latest GKI LTS branch revision including update to 6.1.74</li><li>Settings: enable SIM deletion confirmation by default</li><li>System Updater: clarify name of the notification channel for already being up to date</li><li>Messaging: update MMS configuration database based on Google Messages 20240123_01_RC02</li><li>Dialer: update visual voicemail (VVM) configuration database based on Google Phone 121.0.603393336</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.101.2">version 121.0.6167.101.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.101.3">version 121.0.6167.101.3</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.143.0">version 121.0.6167.143.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.143.1">version 121.0.6167.143.1</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/65">version 65</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/66">version 66</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024012600">2024012600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024012600-redfin">2024012600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024012600">2024012600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024011600 release:</p><ul><li>isolate eSIM activation app from non-system apps to avoid it sharing data with sandboxed Google Play</li><li>make eSIM activation toggle available without sandboxed Google Play installed (eSIM management no longer requires sandboxed Google Play)</li><li>make the eSIM activation app toggle persistent instead of it being disabled at boot</li><li>remove misleading message about device info being sent to Google message before eSIM download</li><li>hardened_malloc: use tag 0 for freed slots instead of reserving a tag to allow using 15 of 16 possible tag values for random tags (there are 3 dynamic exclusions of the random values for the previous tag along with the 2 current or previous adjacent tags)</li><li>Settings: prevent disabling Camera2/CameraX extension provider app (Pixel Camera Services for Pixels) since it breaks apps using CameraX</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro): use a normal reboot on overheating instead of an emergency reboot to harden against physical attacks</li><li>kernel: enable reset attack mitigation for UEFI systems supporting it (Tensor Pixels use minimalistic littlekernel-based boot firmware rather than UEFI and the previous Snapdragon Pixels using UEFI didn't implement this but we may need this for future devices)</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.208</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.147</li><li>kernel (Generic 6.1): update to latest GKI LTS branch revision including update to 6.1.73</li><li>Launcher: disable gradient at the top of the home screen again (change lost with Android 14 QPR1 due to it being reimplemented upstream)</li><li>rewrite HTTPS network time implementation to make it much more maintainable and robust along with providing better debug output via ADB</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/120.0.6099.230.0">version 120.0.6099.230.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.71.0">version 121.0.6167.71.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.101.0">version 121.0.6167.101.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.101.1">version 121.0.6167.101.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-93">version 93</a></li><li>Seedvault: update to latest revision (will be replaced with a better backup implementation in the future)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024011600">2024011600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024011600-redfin">2024011600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024011600">2024011600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024011300 release:</p><ul><li>work around upstream Android bug causing system_server crash due to failed security-related assertion by denying the action without crashing system_server, which avoids turning a buggy security check into a denial of service issue</li><li>add workaround for upstream Android crash reporting bug recording clean f2fs filesystem check results as errors which is resulting in many users receiving filesystem check error reports on GrapheneOS due to our user-facing notifications for serious errors/crashes</li><li>add workaround for upstream Android crash reporting bug causing old crashes to be reported again</li><li>add workaround for upstream Android crash reporting bug wrongly attributing certain app crashes to system_server</li><li>only show kernel crashes when the user opts into showing all system crashes as notifications since there are many false positives caused by hardware issues such as some users having devices which sometimes fail to resume from sleep while idle</li><li>only show report button in log viewer for system_server Java/native crashes, MTE crashes and filesystem check errors (which now have non-error results properly filtered out) due to receiving too many reports about upstream bugs and hardware issues</li><li>hide specific system apps and also sandboxed Google Play from Aurora Store so users don't try to update them through it and receive errors</li><li>Log Viewer: explicitly set status bar color to fix light mode icon colors</li><li>kernel (Pixel 4a (5G), Pixel 5, Pixel 5a): add missing kernel changes from the past 2 releases</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024011300">2024011300</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024011300-redfin">2024011300-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024011300">2024011300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024010400 release:</p><ul><li>replace auto-reboot implementation with a new more hardened implementation based on a timer in the init process (since init crashing reboots the device, unlike system_server) which also avoids rebooting when the device hasn't been unlocked since boot</li><li>reduce default auto-reboot timer from 72 hours to 18 hours</li><li>add log viewer available at <b>Settings &gt; System &gt; View logs</b> to avoid needing developer options for making useful bug reports and inspecting the device for issues</li><li>reimplement our user-facing crash reporting infrastructure with our new log viewer app</li><li>Settings: add links to log viewer in app info and system settings</li><li>show report button in sandboxed Google Play crash report UI</li><li>adevtool: integrate support for Pixel Camera Services (currently provides Night mode for GrapheneOS Camera and other apps on Pixel 6 and later)</li><li>adevtool: improve and clean up infrastructure for device support</li><li>adevtool: drop devices not supported with Android 14</li><li>adevtool: remove unused default permissions configuration</li><li>Contact Scopes: add handling of malformed contact data subtype names to avoid crash</li><li>show notification after hardened_malloc detects memory corruption via a direct check (does not cover memory corruption detected via memory protected address space)</li><li>kernel: disable sysrq by default rather than waiting for init to disable it</li><li>kernel: disable unused sysrq serial support</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.206</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.145</li><li>kernel (Generic 6.1): update to latest GKI LTS branch revision including update to 6.1.69</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-91">version 91</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-92">version 92</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/120.0.6099.210.0">version 120.0.6099.210.0</a></li><li>System Updater: use sentence case for notification channel names</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024010400">2024010400</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024010400-redfin">2024010400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024010400">2024010400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023123100 release:</p><ul><li>full 2024-01-01 security patch level</li><li>full 2024-01-05 security patch level</li><li>rebased onto UQ1A.240105.004 Android Open Source Project release</li><li>kernel (Generic 6.1): update to latest GKI LTS branch revision including update to 6.1.67</li><li>Sandboxed Google Play compatibility layer: stop hiding Android Auto from the Play Store since it breaks Play Store dependent functionality</li><li>Sandboxed Google Play compatibility layer: mark Android Auto as owned by our app repository client to stop the Play Store from updating it</li><li>Sandboxed Google Play compatibility layer: add Network permission to baseline permissions needed for wireless Android Auto</li><li>Sandboxed Google Play compatibility layer: add list of requirements for Android Auto voice commands</li><li>Sandboxed Google Play compatibility layer: add back dedicated name for Sandboxed Google Play crash notification channel</li><li>Sandboxed Google Play compatibility layer: skip Android Auto crash reports when it lacks baseline permissions and show a dedicated notification about the problem instead</li><li>Keyboard: add workaround for multi-locale spell checking and remove our attempt at implementing it properly in the keyboard itself for now</li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/3">version 3</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/120.0.6099.193.0">version 120.0.6099.193.0</a></li><li>adevtool: remove unused permission configuration</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023123100">2023123100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023123100-redfin">2023123100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023123100">2023123100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023123000 release:</p><ul><li>Keyboard: avoid spell checker crash after keyboard's spell checking service is stopped by the OS (regression in the last Alpha channel only release fixing multi-locale spell checking)</li><li>backport upstream fix for Wi-Fi background scan system_server crash</li><li>hardened_malloc / bionic: restore default SIGABRT handler in fatal_error to work around crashlytics bug caused by it using fork instead of clone which triggers a deadlock when malloc locks are held already</li><li>skip missing sensors permission notification with wrong app id</li><li>Sandboxed Google Play compatibility layer: avoid crashes in Android Auto and potentially elsewhere from missing Google Search app to make it a proper optional dependency</li><li>Sandboxed Google Play compatibility layer: fix handling of while-in-use permissions</li><li>Sandboxed Google Play compatibility layer: drop ACCESS_BACKGROUND_LOCATION permission for Android Auto now that while-in-use permission works</li><li>Sandboxed Google Play compatibility layer: add workaround for rare foreground service crash (may be upstream bug)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023123000">2023123000</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023123000-redfin">2023123000-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023123000">2023123000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023121200 release:</p><ul><li>Keyboard: add new implementation of multi-locale spell checking support to fix crashes and other issues</li><li>Sandboxed Google Play compatibility layer: add Android Auto support with the compatibility layer eliminating the need for most of the permissions and a permission menu with 4 toggles for granting the minimal special access required for wired Android Auto, wireless Android Auto, audio routing and phone calls</li><li>Settings: remove confusing mention of Android Auto from Connected devices screen</li><li>exempt non-app system processes from Sensors permission enforcement (fixes some issues including gpsd crashes)</li><li>fix Bluetooth auto-turn-off race condition to avoid crashes</li><li>work around upstream race condition bug in biometric service</li><li>disable support for pre-approving PackageInstaller sessions due to incompatibility with Network permission toggle</li><li>fix several upstream bugs in handling crash reports mainly to improve our user-facing crash reporting system</li><li>use GrapheneOS Widevine provisioning proxy by default</li><li>add settings for changing Widevine provisioning server</li><li>add configuration for setupdesign and setupcompat libraries to improve system UI theme</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.204</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.142</li><li>kernel (Generic 6.1): initial port of GrapheneOS changes for use with emulator builds</li><li>force disable network ADB (Android Debug Bridge) developer option in early boot to improve verified boot security (no user-facing change since it's currently disabled by default later in the boot process, but not robustly)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/120.0.6099.115.0">version 120.0.6099.115.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/120.0.6099.144.0">version 120.0.6099.144.0</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/2">version 2</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-88">version 88</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-89">version 89</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-90">version 90</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/78">version 78</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023121200">2023121200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023121200-redfin">2023121200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023121200">2023121200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro emulator, generic, other targets)</li></ul><p>Changes since the 2023120800 release:</p><ul><li>stop reporting forced reboot (long press power) as a kernel crash</li><li>filter out SoC ID from kernel crash logs (logged by Little Kernel firmware boot stage before the OS)</li><li>temporarily disable memory tagging and hardened_malloc for surfaceflinger process to work around upstream use-after-free bug(s)</li><li>raise max open files for system_server to 256k from the baseline 32k limit used for all processes on Android due to situations where the 32k limit is exhausted, which has become much more common for a small number of users with Android 14 QPR1</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold): backport fix for glibc 2.38 build error to device-specific driver source tree too to end the need for mounting a modified features.h for building host executables</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.201</li><li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.138</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-87">version 87</a></li><li>suppress repetitive sendHistogramChannelIoctl logging (upstream issue)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023120800">2023120800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023120800">2023120800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023120701 release:</p><ul><li>Package Installer: fix crash introduced upstream in Android 14 QPR1 for handling pending user action</li><li>Package Installer: fix crash introduced upstream in Android 14 QPR1 by limiting maximum app snippet icon size</li><li>avoid false positives for our kernel crash reporting when running in the Android emulator</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023120701">2023120701</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023120701">2023120701</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2023120700 release:</p><ul><li>adevtool (Pixel 8, Pixel 8 Pro): update system property removal</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023120700">2023120700</a></h3><p>This is the first quarterly release of Android 14 and includes a bunch of nice improvements including using the phone as a webcam.</p><p>Starting with this release, the Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. Certain driver patches will remain available until the Pixel 5a is end-of-life due to shared code. We'll continue providing all of the Android Open Source Project and GrapheneOS changes for them until the release of Android 15. After Android 15 is released, they'll remain on a legacy Android 14 branch with only the AOSP security patch backports to Android 14 and some additional changes backported by us on a best effort basis. This is the same kind of extended support we provided for the Pixel 4 and Pixel 4 XL.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023120700">2023120700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023120400 release:</p><ul><li>full 2023-12-01 security patch level for 6th/7th generation Pixels too</li><li>full 2023-12-05 security patch level</li><li>rebased onto UQ1A.231205.015 Android Open Source Project release, which is the first quarterly maintenance/feature release for Android 14</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision</li><li>Sandboxed Google Play compatibility layer: disable privileged AlarmManager.FLAG_PRIORITIZE to prevent crashes (this API is a no-op when Unrestricted battery mode is granted anyway)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-86">version 86</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023120400">2023120400</a></h3><p>The December release of the Android Open Source Project and stock Pixel OS will be the first quarterly release of Android 14. It will likely be available this week, but hasn't been published yet. Since there hasn't been a release yet this month, we're publishing an early December security update based on the AOSP backports to Android 14.</p><p>It's unclear if 6th/7th generation Pixels received a specific Mali GPU kernel driver patch so we aren't raising the patch level for these until the official December release is available. We often backport these patches early but we don't know which patch corresponds to which CVE ID so we can't raise the claimed patch level. ARM covers up the details publicly and only releases tarballs for each major revision without the Git commit history or individual security patch backports they make available to partners, despite partners being allowed to apply those in public Git repositories. We can often figure out the patch corresponding to a CVE ID or vice versa through ARM partners publishing it, but we haven't been able to in this case.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023120400">2023120400</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023120400-shusky">2023120400-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023112900 release:</p><ul><li>full 2023-12-01 security patch level (6th/7th generation Pixels may be missing a 2023-11-05 Mali GPU patch so we've frozen the patch level string until the official December update)</li><li>Pixel 8, Pixel 8 Pro: use more modern target CPU configuration</li><li>System Updater: enable non-low (currently 20% or higher) battery requirement for the update job by default (will not change for users who have previously opened the update settings due to how they're implemented)</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/120.0.6099.43.0">version 120.0.6099.43.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-85">version 85</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023112900">2023112900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023112900">2023112900</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023112900-shusky">2023112900-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023112600 release:</p><ul><li>improve compatibility of the opt-in forced hardware memory tagging mode for user installed apps</li><li>add AppCompatConfig for out-of-band updates to app compatibility configuration such as enabling memory tagging by default for apps compatible with it in the default mode and disabling it for apps not compatible with it when users globally enable it</li><li>suppress native debugging notification for sandboxed Google Play services since it works without it</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.200</li><li>Settings: hide global memory tagging setting from secondary users</li><li>Settings: add toggle for system process crash notifications and disable it by default since it uncovers a lot of upstream bugs</li><li>Settings: clarify description for third party app memory tagging toggle in the Security settings menu</li><li>Settings: fix typo in the extended virtual address space explanation</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.193.0">version 119.0.6045.193.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023112600">2023112600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023112600">2023112600</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023112600-shusky">2023112600-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023111500 release:</p><ul><li>improve existing infrastructure and settings for per-app hardening control</li><li>add new infrastructure for dynamic SELinux flags for apps</li><li>replace static SELinux policy disabling dynamic native code generation for base system apps with dynamic SELinux flag</li><li>replace YAMA LSM with dynamic SELinux flag for ptrace access</li><li>add per-app toggle for native debugging</li><li>add global toggle to disable native debugging for user installed apps by default</li><li>add per-app memory tagging toggle for user installed apps</li><li>add global toggle to enable memory tagging for user installed apps by default</li><li>add logging infrastructure for dynamic GrapheneOS SELinux flags</li><li>raise post-boot audit message rate limit from 5 to 50 per second</li><li>add more infrastructure and tests for per-app hardening control</li><li>fix Android bug with rate limiting for non-app tombstones (crash info for reporting bugs)</li><li>notify the user about notable system journal entries including kernel crash, file system check error, system_server crash, system app native crash and non-app process native crash</li><li>notify the user after memory tagging detects memory corruption in an app</li><li>notify the user after an app is blocked from accessing ptrace by the native debugging toggle</li><li>Pixel 8, Pixel 8 Pro: migrate to using our standard 5.15.137 GKI LTS kernel as the base with reverts for changes that are not compatible with the driver tree yet</li><li>include more info about Java and native crashes, ANRs, low memory conditions. kernel crash logs and filesystem check errors in bug report zips manually captured by users which on the stock OS is uploaded by Play services</li><li>Sandboxed Google Play compatibility layer: allow compatibility layer to show the error report UI</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-84">version 84</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.163.2">version 119.0.6045.163.2</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023111500">2023111500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023111500">2023111500</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023111500-shusky">2023111500-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023110700 release:</p><ul><li>Sandboxed Google Play compatibility layer: replace cross-user intent broadcasts with user-local ones to avoid occasional background service crashes</li><li>fix upstream bug causing crash for previewing live wallpapers</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision</li><li>Seedvault: update to latest revision (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.134.0">version 119.0.6045.134.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.163.0">version 119.0.6045.163.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.163.1">version 119.0.6045.163.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-83">version 83</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/64">version 64</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/77">version 77</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023110700">2023110700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023110700">2023110700</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023110700-shusky">2023110700-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023103100 release:</p><ul><li>full 2023-11-01 security patch level</li><li>full 2023-11-05 security patch level for generic targets and 5th/8th generation Pixels (6th/7th generation Pixels are marked as 2023-11-01 upstream which may be due to a missing Mali GPU kernel patch we can work on obtaining to apply early)</li><li>rebased onto UP1A.231105.003 (generic) and UD1A.231105.004 (shusky) Android Open Source Project releases</li><li>Pixel 8, Pixel 8 Pro: always enable hardware memory tagging (there is no longer an opt-in toggle) which is currently used everywhere other than Vanadium (coming soon), vendor executables and user installed apps with their own native code not marked as compatible with memory tagging</li><li>disable GWP-ASan since it's a bug finding feature rather than a hardening feature and doesn't preserve all the hardened_malloc security properties for the random allocations in random system processes where it gets activated especially now that memory tagging is supported</li><li>Launcher: add missing catch for null pointer exception (upstream bug) triggered by Signal</li><li>revert change to show crash dialog for first crash of an app since boot since this results in a high support burden from the many third party app crashes it uncovers especially since it's not enabled on the stock OS</li><li>always compile VPN service packages with speed filter to avoid background recompilation since many of these apps only automatically connect at boot and the user has to manually reconnect if the OS restarts them such as when users manually trigger app restart via the background recompilation notification</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.199</li><li>backport health permission UI fixes from AOSP</li><li>backport DocumentsUI (Files) fix from AOSP preventing bypassing restrictions via initial open directory</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-81">version 81</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-82">version 82</a></li><li>use sdk_phone_x86_64 (emulator) target as the default one for convenience</li><li>flash-all: raise minimum fastboot version to 34.0.4</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023103100">2023103100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023103100">2023103100</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023103100-shusky">2023103100-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023103000 release:</p><ul><li>Keyboard: include words from all active locales in spell checking to support multiple locales again after the port to Android 14</li><li>Gallery: revert one of the 3 improvements to preview resolution due to it causing out-of-memory errors</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.66.0">version 119.0.6045.66.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023103000">2023103000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023103000">2023103000</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023103000-shusky">2023103000-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023102300 release:</p><ul><li>add infrastructure for hardware memory tagging support</li><li>hardened_malloc: add support for hardware memory tagging launched with the ARMv9 cores on the Pixel 8 and Pixel 8 Pro</li><li>Settings: enable memory tagging toggle at <b>Settings &gt; Security &gt; More security settings &gt; Advanced memory protection</b> beta on supported devices (Pixel 8 and Pixel 8 Pro)</li><li>Pixel 8, Pixel 8 Pro: enable memory tagging support for everything built by GrapheneOS (other than Vanadium, since Chromium currently disables it) and also user installed apps without native libraries (will be expanded to Vanadium later along with the option to use it for all user installed apps)</li><li>Pixel 8, Pixel 8 Pro: use asymmetric memory tagging mode on all cores to provide much higher security than asynchronous mode without much more overhead unlike the very expensive synchronous mode without any clear security benefits over asymmetric</li><li>enable parallel compilation of non-precompiled bytecode to native code for first-boot and first-boot-after-update with 2 processes for now (can be increased later)</li><li>improve user interface for reporting background package compilation progress</li><li>show crash dialog for first crash of an app since boot instead of waiting until the second crash like upstream Android</li><li>Gallery: fix low resolution image preview in editor</li><li>restore Android 13 behavior for installing APKs from the file manager by requesting permission for the app which created the APK (current Google Files behavior is a bit different and requests permission for Google Files, but the AOSP Files approach seems more useful)</li><li>SELinux policy: use per-app-instance MLS level for the update client domain as used for regular apps to provide better isolation from other system components</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.198</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.137</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/118.0.5993.111.0">version 118.0.5993.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.53.0">version 119.0.6045.53.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.53.1">version 119.0.6045.53.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-80">version 80</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023102300">2023102300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023102300">2023102300</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023102300-shusky">2023102300-shusky</a> (Pixel 8, Pixel 8 Pro)</li></ul><p>Changes since the 2023101300 release:</p><ul><li>initial non-experimental release for Pixel 8 and Pixel 8 Pro support</li><li>speed up skipping compilation of system packages with dexpreopt (precompilation to native code) to improve post-update boot time</li><li>backport assorted dexpreopt fixes to make it work for more system packages again to improve verified boot security, free up wasted disk space and reduce post-update boot time</li><li>use speed-profile compilation for user installed packages for first boot of an update to significantly improve boot time, then recompile with full speed optimization in the background with a progress notification and a notification when it's finished for respawning apps</li><li>temporarily disable otapreopt (precompilation of apps in the background in update Finalizing step) due to it being broken in Android 14</li><li>Gallery: remove optional dependency to fix dexpreopt (precompilation to native code)</li><li>Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold: fix support for Widevine L1 on Android 14</li><li>fix PIN scrambling for SIM PIN (regression from port to Android 14)</li><li>handle new Android 14 network time code path for our feature making the automatic time toggle control whether network time connections are made</li><li>remove standard special case enabling Android 14 auto-confirm PIN by default for 6 digit PINs</li><li>allow system apps to make sticky notifications again (important for System Updater to avoid users missing the notice to reboot after update installation)</li><li>System Updater: add option to require that the device is charging</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.134</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/76">version 76</a></li><li>Apps: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/21">version 21</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/118.0.5993.80.0">version 118.0.5993.80.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-79">version 79</a></li><li>improve GrapheneOS system_server infrastructure</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023101300">2023101300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023101300">2023101300</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2023101100 release:</p><ul><li>exempt non-app system packages from new package visibility restrictions to fix many APIs in secondary users</li><li>Sandboxed Google Play compatibility layer: expand background activity launch shim to all the core Google Play apps to fix sandboxed Play Store compatibility issues with Android 14</li><li>Sandboxed Google Play compatibility layer: fix "Don't show again" notification action which broke after Android 14 port</li><li>Pixel 5: add back support for battery share (reverse wireless charging) via the new infrastructure in Android 14 which we already adopted for 6th/7th/8th generation Pixels</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-78">version 78</a></li><li>Settings: reorder auto-reboot options from least disruptive to most secure</li><li>Settings: add 18 hours as an auto-reboot option</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023101100">2023101100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023101100">2023101100</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2023100900 release:</p><ul><li>enable customizing lock screen shortcuts</li><li>Launcher: set target API level to 33 since it doesn't properly support 34 and it prevents adding widgets among other potential issues (Pixel Launcher fork in the stock Pixel OS still uses 33 too, so this is an AOSP-specific upstream bug)</li><li>Launcher: delete broken legacy shortcuts instead of crashing (upstream bug)</li><li>Sandboxed Google Play compatibility layer: enable DynamiteLoader v2</li><li>fix per-app hardening configuration for apps missing from the Owner user</li><li>fix Bluetooth auto-turn-off</li><li>Settings: avoid crashes when changing user restrictions for guest users (upstream bug)</li><li>do not delete compiled code of hibernated apps</li><li>curl: update to 8.4.0 to fix CVE-2023-38545 and assorted minor issues (Android may not use this functionality, but it should be fixed in case it does)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/118.0.5993.65.0">version 118.0.5993.65.0</a></li><li>remove unnecessary wrapper for registering receivers</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023100900">2023100900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100900">2023100900</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2023100800 release:</p><ul><li>temporarily unsuspend work profiles when resuming them to avoid our stricter pause approach causing issues</li><li>Settings: split title/summary for automatic exploit protection compatibility mode</li><li>Settings: fix upstream bug causing crash when accessing tethering settings from secondary users where they're unavailable</li><li>System Updater: set foreground service type to special</li><li>System Updater: update minimum and target API level to 34 (Android 14)</li><li>fix port of our change enabling usage timeline for all permission groups</li><li>add back compiling code not built with signed integer overflow checking using -fwrapv to make it well defined</li><li>add back very minor hardening involving making more data read only</li><li>Seedvault: update to latest revision (will be replaced with a better backup implementation in the future)</li><li>Health Fitness: disable functionality for showing available apps, updating apps and sending feedback when Google Play is unavailable (these options may be removed completely in the future)</li><li>Health Fitness: check for Google Play via signature instead of whether it's a system app to support sandboxed Google Play</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023100800">2023100800</a></h3><p>This is the initial non-experimental release of GrapheneOS based on Android 14. Our initial public experimental release (2023100600) was published on October 6th so there have already been a couple days of public testing. All of our documented features are now ported to Android 14. We'll be continuing to work on fixing regressions including new Android bugs and new compatibility issues caused by our features. However, it's already stable and usable.</p><p>This release provides the full 2023-10-06 patch level for all supported devices along with the recommended security patches only included in Android 14.</p><p>Android 13 is no longer actively developed upstream and now only receives backports of the Android Security Bulletin patches, not the recommended patches included in the latest stable release of Android. Pixels are also now only supported via Android 14 and require Android 14 to achieve a patch level above 2023-10-01. Android 14 has had publicly available experimental releases since February 2023 and is already a mature OS. It also contains significant privacy and security enhancements which more than offset the attack surface from added features. These reasons are why we have so heavily prioritized porting to Android 14 and began to defer more and more of our other work until after Android 14 since around July 2023.</p><p>Pixel 4, Pixel 4 XL and Pixel 4a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100800">2023100800</a> (Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2023100300 release:</p><ul><li>full 2023-10-06 security patch level</li><li>rebased onto UP1A.231005.007 Android Open Source Project release as the initial port of all GrapheneOS features to Android 14</li><li>add default-enabled toggle for automatic per-app exploit protection compatibility mode configuration</li><li>temporarily add Google Camera to automatic exception list for hardened_malloc</li><li>add back support for displaying app compilation progress at boot</li><li>restore Android 13 work profile pause behavior by stopping the profile from running instead of only suspending apps</li><li>fix cosmetic issue for adevtool envsetup.sh integration</li><li>adevtool: download: add option to unpack factory images</li><li>adevtool: collect-state: fix the output file name format</li><li>adevtool: collect-state: add an option to automatically make prep OS build</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/117.0.5938.153.0">version 117.0.5938.153.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/118.0.5993.48.0">version 118.0.5993.48.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-77">version 77</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/75">version 75</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023100300">2023100300</a></h3><p>Android 14 is replacing Android 13 this month. There will no longer be any monthly or quarterly releases of Android 13, only the monthly backports of Android Security Bulletin patches. This is an early October release based on the Android Security Bulletin backports. We'll need to port to Android 14 to provide the full 2023-10-06 patch level. We've spent months porting to Android 14 in advance in order to make this migration as smooth and quick as possible. We weren't accepted as an Android partner so we don't have full early access to new major releases, but we've had partial early access to the sources and were able to do a lot of the porting in advance.</p><p>There wasn't a proper Android Open Source Project or stock Pixel OS release for September since Android 14 was meant to be released. They only shipped a release marked as having the 2023-09-01 patch level, but most patches which were going to be included in 2023-09-05 were deferred to October and most of the devices ended up providing the published 2023-09-05 patch level. Devices with a Qualcomm SoC (Pixel 4a (5G), Pixel 5, Pixel 5a) or standalone Qualcomm Wi-Fi (Pixel 7a) still need firmware/driver patches for 2023-09-05. Other supported devices (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel Tablet, Pixel Fold) were already on the 2023-09-05 patch level and will now be on the 2023-10-01 patch level. All of these devices will be quickly upgraded to the full Android 14 2023-10-05 patch level once it's released.</p><p>Pixel 4, Pixel 4 XL and Pixel 4a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100300-coral">2023100300-coral</a> (Pixel 4, Pixel 4 XL)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100300">2023100300</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100300-tangorpro">2023100300-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100300-felix">2023100300-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023100100 release:</p><ul><li>full 2023-10-01 security patch level (early release based on AOSP 13 security backports since the AOSP/stock monthly release is not available yet)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023100100">2023100100</a></h3><p>Pixel 4, Pixel 4 XL and Pixel 4a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100100-coral">2023100100-coral</a> (Pixel 4, Pixel 4 XL)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100100">2023100100</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100100-tangorpro">2023100100-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023100100-felix">2023100100-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023091800 release:</p><ul><li>fix upstream bug auto-dismissing crash dialogs</li><li>improve readability of native crash reports</li><li>Settings: remove Private DNS setting for secondary users since it's not currently per-profile like VPN configuration but rather is global like Wi-Fi configuration</li><li>Settings: remove connectivity check setting for secondary users</li><li>Dialer: disable false gesture detection for answering calls until the faulty implementation in the AOSP Dialer app is replaced</li><li>hardened_malloc: improve fatal error reporting to include the abort message in Android crash reports</li><li>Messaging: work around upstream null pointer exception bug</li><li>libvpx: apply patch for CVE-2023-5217 to the standalone AOSP libvpx library, which was already fixed in the 117.0.5938.140.0 release of Vanadium</li><li>Pixel 4, Pixel 4 XL: add upstream sensor-related app compatibility fix from the September release already included for other devices</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold): add upstream build reproducibility fix</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-75">version 75</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-76">version 76</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/117.0.5938.140.0">version 117.0.5938.140.0</a></li><li>replace GrapheneOS themes stub app with AOSP themes stub app with our configuration ported over to it (AOSP didn't used to include a themes stub app)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023091800">2023091800</a></h3><p>The September releases of AOSP and the stock OS came out on 2023-09-18 and are incorporated into this release. Unusually, they still set the patch level to 2023-09-01 despite having all listed patches for 2023-09-05 for some of the devices such as the Pixel 6 and Pixel 7. We left the listed patch level alone to avoid delaying the release for aesthetic reasons while we figured out where it could be raised due to delayed Qualcomm firmware patches. We shipped 2023-09-01 in our much earlier 2023090600 release but this is the official September release from AOSP and the stock OS rather than just applying the Android Security Bulletin backports to Android 13.</p><p>The strange timing and inclusion of only a single patch (Mali GPU kernel driver fix) in the September Pixel Update Bulletin is due to Android 14 being scheduled for this month but delayed to October. The Pixel Update Bulletin for Android 14 will include a large number of recommended AOSP security patches and many hardware related patches, neither of which will be backported to Android 13, so we've already put a significant effort into porting to Android 14 via our limited early access to the source code. We aim to have our Android 14 port available as soon as possible after the stable release is published due to the importance for security. It's unfortunate we don't have full access to the sources in advance like Android partners, but we've had access to more than we usually do this year and for longer due to the delay.</p><p>We've also included additional Mali GPU kernel driver patches and a libwebp patch in this release, similar to the kernel.org LTS patches we ship on a regular basis many months before Android. We'll do more of this in the future as our resources and partnerships grow, but we don't have much ability to ship firmware patches earlier until there's hardware built to run GrapheneOS.</p><p>Pixel 4, Pixel 4 XL and Pixel 4a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023091800-coral">2023091800-coral</a> (Pixel 4, Pixel 4 XL)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023091800">2023091800</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023091800-tangorpro">2023091800-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023091800-felix">2023091800-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023090600 release:</p><ul><li>integrate official September update as a replacement for the backports in the last release</li><li>rebased onto TQ3A.230901.001 (generic, coral), TQ3A.230901.001.B1 (tangorpro) and TQ3C.230901.001.A1 (felix) Android Open Source Project releases</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold): backport additional Mali GPU driver security fixes from Android 14 Beta 5.3</li><li>webp: backport fix for CVE-2023-4863 not included in the Android September security patch level</li><li>Settings: remove Storage manager toggle since it lacks an implementation without Play services integrated into the OS</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.131</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/117.0.5938.44.0">version 117.0.5938.44.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/117.0.5938.44.1">version 117.0.5938.44.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/117.0.5938.60.0">version 117.0.5938.60.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-73">version 73</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-74">version 74</a></li><li>adevtool: add command for fetching info about stock OS kernels from AOSP repositories</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023090600">2023090600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090600-coral">2023090600-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090600">2023090600</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090600-tangorpro">2023090600-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090600-felix">2023090600-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023090200 release:</p><ul><li>full 2023-09-01 security patch level (early release based on AOSP 13 security backports since the AOSP/stock monthly release is not available yet)</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.194</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.130</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.172.0">version 116.0.5845.172.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023090200">2023090200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090200-coral">2023090200-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090200">2023090200</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090200-tangorpro">2023090200-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023090200-felix">2023090200-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023080800 release:</p><ul><li>add support for viewing 7 days of history in the privacy dashboard via the official toggle instead of our previous approach</li><li>Sandboxed Google Play compatibility layer: hide eSIM activation app from Play Store since it can't update it</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.192</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.128</li><li>adevtool: fix 6th generation Pixel builds with PRODUCT_ENFORCE_RRO_TARGETS to make vendor generation easier</li><li>adevtool: major overhaul fixing resource parsing bugs via protobuf aapt2 output, removing depencency on BUILD_BROKEN_ELF_PREBUILT_PRODUCT_COPY_FILES, verifying hashes of vendor files, unpacking via debugfs/fsck.erofs to avoid needing mount privileges on the workstation and other UX / error checking improvements</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.78.0">version 116.0.5845.78.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.92.0">version 116.0.5845.92.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.114.0">version 116.0.5845.114.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.114.1">version 116.0.5845.114.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.163.0">version 116.0.5845.163.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/116.0.5845.163.1">version 116.0.5845.163.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-67">version 67</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-68">version 68</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-69">version 69</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-70">version 70</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-71">version 71</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-72">version 72</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023080800">2023080800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080800-coral">2023080800-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080800">2023080800</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080800-tangorpro">2023080800-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080800-felix">2023080800-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023080700 release:</p><ul><li>Sandboxed Google Play compatibility layer: fix handling of app install confirmation for the sandboxed Play Store in background processes since they're moving towards it with a partially deployed feature flag</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023080700">2023080700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080700-coral">2023080700-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080700">2023080700</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080700-tangorpro">2023080700-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023080700-felix">2023080700-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023072600 release:</p><ul><li>full 2023-08-01 security patch level</li><li>full 2023-08-05 security patch level</li><li>rebased onto TQ3A.230805.001 (generic, coral), TQ3A.230805.001.B1 (tangorpro) and TQ3C.230805.001.A3 (felix) Android Open Source Project releases</li><li>add workarounds for upstream Android issue with user profiles causing screenshots to break the recent app list and launcher</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.187</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.120</li><li>Updater: add low-level ACCESS_NETWORK_STATE permission to prepare for it being required to run scheduled jobs depending on network state in Android 14</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/115.0.5790.166.0">version 115.0.5790.166.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-65">version 65</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-66">version 66</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023072600">2023072600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072600-coral">2023072600-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072600">2023072600</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072600-tangorpro">2023072600-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072600-felix">2023072600-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023072400 release:</p><ul><li>Sandboxed Google Play compatibility layer: fix crash caused by regression in the previous release which was caught in Alpha/Beta testing and blocked us from releasing it to the Stable channel</li><li>Settings: improve GrapheneOS user management setting infrastructure</li><li>Settings: move run in background settings right below switch user settings</li><li>Settings: unify app install settings into three options for non-guest users and two for guest users and move them right above the install available apps settings</li><li>Settings: remove incorrect caching of default guest user manager restrictions</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/115.0.5790.138.0">version 115.0.5790.138.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023072400">2023072400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072400-coral">2023072400-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072400">2023072400</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072400-tangorpro">2023072400-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023072400-felix">2023072400-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023071100 release:</p><ul><li>replace our changes to AOSP APN and CarrierConfig configurations with a GrapheneOS CarrierConfig2 app for easier maintenance, improved MVNO support and support for recently added configuration options</li><li>add infrastructure for comparing CarrierConfig2 against Google's CarrierSettings app</li><li>show installer package name in error reports to help with identifying issues caused by broken installers</li><li>update timezone module to Android mainline 331910000</li><li>Sandboxed Google Play compatibility layer: support overriding ComponentEnabledSettings via GmsCompatConfig</li><li>Sandboxed Google Play compatibility layer: add missing string for "Missing Play Games app" notification channel name</li><li>Sandboxed Google Play compatibility layer: avoid uncaught exceptions with location rerouting when client only has coarse location permission</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/115.0.5790.85.0">version 115.0.5790.85.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/115.0.5790.136.0">version 115.0.5790.136.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-63">version 63</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-64">version 64</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/74">version 74</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023071100">2023071100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023071100-coral">2023071100-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023071100">2023071100</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023071100-tangorpro">2023071100-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023071100-felix">2023071100-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023070500 release:</p><ul><li>Pixel Fold: rebased onto TQ3C.230705.001.C1 Android Open Source Project release</li><li>fix incomplete eSIM activation app initialization</li><li>do not allow enabling eSIM activation app on first boot due to issues from not including the Google Setup Wizard (UI explains that a reboot is required)</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.186</li><li>SELinux policy (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Fold): allow OemRilHookService to access IOemSlsiRadioExternal hwservice in order to avoid occasional battery drain from retries</li><li>Sandboxed Google Play compatibility layer: handle location rerouting inside the app using the Google Play location service to have the location permission usage and battery consumption properly attributed among other improvements</li><li>Sandboxed Google Play compatibility layer: notify user when "Nearby devices" perm is needed to connect to Wear OS</li><li>Sandboxed Google Play compatibility layer: show name of calling app in "Missing Play Games app" notification</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-62">version 62</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023070500">2023070500</a></h3><p>July release of the Android Open Source Project and stock OS for the Pixel Fold is delayed, likely only for a few days. The device was just released on June 27th with official support shipped in a GrapheneOS release on June 28th so it doesn't make sense to do an incomplete early release. We'll include it as part of this release when the official July release is available.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023070500-coral">2023070500-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023070500">2023070500</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023070500-tangorpro">2023070500-tangorpro</a> (Pixel Tablet)</li></ul><p>Changes since the 2023062800 release:</p><ul><li>full 2023-07-01 security patch level</li><li>full 2023-07-05 security patch level</li><li>rebased onto TQ3A.230705.001 (generic, coral) and TQ3A.230705.001.B4 (tangorpro) Android Open Source Project releases</li><li>do not report pseudo-"network" location provider to be always disabled (resolves regression with network location compatibility from <a href="https://grapheneos.org/releases#2023062300">2023062300</a>)</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.185</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): revert 2 f2fs garbage collection optimizations backported in the Android GKI tree since at least one of them appears to be broken which we ran into in our previous <a href="https://grapheneos.org/releases#2023061400">2023061400 release</a> and now multiple OEMs including Xiaomi have encountered the issue in their own testing too</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.119</li><li>disable unused instant app features at boot</li><li>disable problematic "Add users from lock screen" setting at boot</li><li>Settings: remove problematic "Add users from lock screen" setting</li><li>Dialer: re-enable false gesture detection for answering calls, which can be replaced with a newer implementation in the near future instead of it being removed</li><li>Settings: require device restart to disable eSIM activation app via our toggle</li><li>Seedvault: update to latest revision (will be replaced with a better backup implementation in the future)</li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/17">version 17</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-61">version 61</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023062800">2023062800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062800-coral">2023062800-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062800">2023062800</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062800-tangorpro">2023062800-tangorpro</a> (Pixel Tablet)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062800-felix">2023062800-felix</a> (Pixel Fold)</li></ul><p>Changes since the 2023062300 release:</p><ul><li>add initial Pixel Fold support</li><li>replace unused BUILD_ID field with device name in release channel metadata</li><li>System Updater: add enforcement of device name in release channel metadata as a misuse resistance improvement</li><li>Settings: mark DSUs (Dynamic System Updates) as unsupported</li><li>Launcher: add back Storage Scopes and Contact Scopes links to launcher icon shortcuts since this is now separate from the recent apps screen</li><li>Pixel Tablet: set default screen rotation to landscape mode (270 degrees) since we disable auto-rotation by default (due to the manual rotate button appearing after rotation) and the current default means that the device starts locked in portrait mode in the initial setup which gives a bad impression</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): add missing non-security patch</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/114.0.5735.196.0">version 114.0.5735.196.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/73">version 73</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023062300">2023062300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062300-coral">2023062300-coral</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062300">2023062300</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2023062301-tangorpro">2023062301-tangorpro</a> (Pixel Tablet)</li></ul><p>Changes since the 2023061402 release:</p><ul><li>Sandboxed Google Play compatibility layer: fix compatibility with Nearby Share with current Play services versions</li><li>add production ready Pixel Tablet support (we published our initial release for it on June 21st, but this is the first production release with tags)</li><li>ignore non-system packages for location indicator exemptions, getLocationBypassPackages(), Qualified Network Services, telephony data services, device provisioning and wlan/wwan wireless network services to resolve an upstream vulnerability in the approach to exemptions impacting the Pixel Tablet</li><li>Settings: hide eSIM activation app toggle when the app isn't included in the OS such as the Pixel Tablet</li><li>prevent adding guest user on lockscreen via adding new users on lockscreen is disabled (UI only appears on large screens such as the Pixel Tablet)</li><li>improve compatibility with apps trying to use a network location provider when none is available</li><li>fix work profile screenshot crash caused by missing configuration in AOSP</li><li>use unified tags based on our build number rather than the standard <var>BUILD_ID</var>.<var>BUILD_NUMBER</var></li><li>Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a: set <var>BUILD_ID</var> to match stock OS again</li><li>Settings: improve our infrastructure for user management toggles</li><li>Settings: add toggle for preventing a user from running in the background</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.110</li><li>adevtool: add support for devices without a cellular baseband</li><li>adevtool: make adding vendor_kernel_boot partition-exists generic</li><li>adevtool: disable broken support for file reference overlays</li><li>simplify Pixel prototype check by comparing brand instead of device model</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-58">version 58</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-59">version 59</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-60">version 60</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/72">version 72</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023061402">2023061402</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023061402">TP1A.221005.002.B2.2023061402</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ3A.230605.012.2023061402">TQ3A.230605.012.2023061402</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li></ul><p>Changes since the 2023061400 release:</p><ul><li>enable "Enhanced PIN privacy" feature by default to disable lockscreen PIN animations (configurable via PIN screen lock settings using the gear icon)</li><li>fix upstream bug in Android 13 QPR3 causing crash when selecting a wallpaper</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Generic 5.10): revert update to latest GKI LTS branch revision due to it potentially causing very rare update failures that are successfully rolled back (note: this is not part of the June Android 13 QPR3 release but rather we are normally months ahead on core kernel updates due to using a bleeding edge GKI release and we'll be a little bit less ahead now)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023061400">2023061400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023061400">TP1A.221005.002.B2.2023061400</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ3A.230605.012.2023061400">TQ3A.230605.012.2023061400</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, emulator, generic, other targets)</li></ul><p>Changes since the 2023060700 release:</p><ul><li>full 2023-06-05 security patch level (official AOSP and stock OS June security update was earlier today)</li><li>rebased onto TQ3A.230605.012 release, which is the third quarterly maintenance/feature release for Android 13 (released earlier today)</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Generic 5.10): update to latest GKI LTS branch revision</li><li>Gallery: remove broken widgets (AOSP Gallery will eventually be replaced with a much better app)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/114.0.5735.131.0">version 114.0.5735.131.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-57">version 57</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023060700">2023060700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023060700">TP1A.221005.002.B2.2023060700</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2A.230505.002.2023060700">TQ2A.230505.002.2023060700</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2B.230505.005.A1.2023060700">TQ2B.230505.005.A1.2023060700</a> (Pixel 7a)</li></ul><p>Changes since the 2023052900 release:</p><ul><li>full 2023-06-01 security patch level (early release based on AOSP 13 security backports since the AOSP/stock QPR3 release is not available yet)</li><li>partial 2023-06-05 security patch level (full firmware and userspace patches will not be available until the AOSP/stock QPR3 release and some of the kernel changes depend on those too)</li><li>fix Contact Scopes UI handling of absent number/email type</li><li>remove E-Tugra Certificate Authority</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/114.0.5735.58.0">version 114.0.5735.58.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/114.0.5735.61.0">version 114.0.5735.61.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/71">version 71</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/63">version 63</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-56">version 56</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023052900">2023052900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023052900">TP1A.221005.002.B2.2023052900</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2A.230505.002.2023052900">TQ2A.230505.002.2023052900</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2B.230505.005.A1.2023052900">TQ2B.230505.005.A1.2023052900</a> (Pixel 7a)</li></ul><p>Changes since the 2023052800 release:</p><ul><li>avoid disabling DNS-over-TLS resolver test queries as part of disabling connectivity checks since it breaks automatic mode</li><li>fix Contact Scopes regression blocking granting Contacts permission via the permission screen</li><li>fix native debug toggle regression</li><li>Pixel 7a: keep standalone project repositories in sync for the device branch</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023052800">2023052800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023052800">TP1A.221005.002.B2.2023052800</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2A.230505.002.2023052800">TQ2A.230505.002.2023052800</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2B.230505.005.A1.2023052800">TQ2B.230505.005.A1.2023052800</a> (Pixel 7a)</li></ul><p>Changes since the 2023051600 release:</p><ul><li>use GrapheneOS name by default for remaining DNS resolver name resolution tests</li><li>extend GrapheneOS toggle to remaining DNS resolver name resolution tests</li><li>port remaining GrapheneOS settings to modern GrapheneOS settings infrastructure</li><li>improve compatibility of revoking the Network permission by treating the network as down for more APIs</li><li>improve infrastructure for the Network permission</li><li>improve Contact Scopes user interface, fix various minor bugs and improve app compatibility</li><li>Dialer: support up to 12 buttons instead of 6 to work around call recording going beyond the limit</li><li>Messaging: update MMS configuration database based on Google Messages 20230502_01_RC04</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/113.0.5672.132.0">version 113.0.5672.132.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/113.0.5672.163.0">version 113.0.5672.163.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/114.0.5735.53.0">version 114.0.5735.53.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-53">version 53</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-54">version 54</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-55">version 55</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023051600">2023051600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023051600">TP1A.221005.002.B2.2023051600</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2A.230505.002.2023051600">TQ2A.230505.002.2023051600</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2B.230505.005.A1.2023051600">TQ2A.230505.002.2023051600</a> (Pixel 7a)</li></ul><p>Changes since the 2023050500 release:</p><ul><li>add initial Contact Scopes feature as an alternative to granting the Contacts permission</li><li>improve Storage Scopes performance and robustness</li><li>improve GrapheneOS package state infrastructure</li><li>add production ready Pixel 7a support</li><li>Settings: fix obtaining maximum peak refresh rate for smooth display field for devices without smooth display enabled by default (Pixel 7a)</li><li>factory images flash-all script: raise minimum fastboot version for Windows to 33.0.3 too</li><li>factory images flash-all script: add device model check to Windows too</li><li>carriersettings-extractor: drop unused android-prepare-vendor support (all supported devices use adevtool)</li><li>enable non-flattened APEX modules for all targets (previously only enabled for 6th/7th generation Pixels which have hard dependencies on it)</li><li>extend making userspace function pointer tables read-only</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.178</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/70">version 70</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-52">version 52</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023050500">2023050500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023050500">TP1A.221005.002.B2.2023050500</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2A.230505.002.2023050500">TQ2A.230505.002.2023050500</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023050100 release:</p><ul><li>add support for disabling PSDS in addition to the GrapheneOS server and standard server options</li><li>Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a: add support for controlling PSDS on Qualcomm SoC devices to extend PSDS configuration to them along with using the GrapheneOS PSDS cache by default</li><li>Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a: disable User-Agent for Qualcomm PSDS (XTRA) via xtra-daemon hooking to avoid providing device information to the server (we already removed the hardware identifier via SELinux policy in a previous release)</li><li>Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a: use time.grapheneos.org for XTRA NTP and qualcomm.psds.grapheneos.org for XTRA PSDS downloads by default</li><li>Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a: always use most complete / generic Qualcomm PSDS (XTRA) variant via xtra-daemon hooking to avoid leaking info on radio variant or region</li><li>Settings: improve infrastructure for GrapheneOS settings</li><li>Settings: port remote key provisioning setting to new infrastructure</li><li>Settings: move PSDS configuration to Location settings with our SUPL configuration</li><li>Settings: port SUPL setting to new infrastructure</li><li>Settings: remove icon for Internet connectivity check and remote key provisioning settings for now</li><li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro): Mali GPU driver update</li><li>System Updater: add TLS key pinning with expiration 2 months in the future to make TLS more useful as an additional layer of security before the 3 layers of offline update signing with downgrade protection (update package signature, update_engine payload signature and verified boot signatures) while also avoiding blocking updates on out-of-date installs falling behind changes to our TLS certificate approach</li><li>update timezone module to Android mainline 331314030 (based on tzdata 2023a)</li><li>kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.106</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/113.0.5672.77.0">version 113.0.5672.77.0</a></li><li>Apps: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/19">version 19</a></li><li>Apps: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/20">version 20</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-51">version 51</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2023050100">2023050100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TP1A.221005.002.B2.2023050100">TP1A.221005.002.B2.2023050100</a> (Pixel 4, Pixel 4 XL) — extended support release for legacy devices with frozen 2022-11-01 patch level</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/TQ2A.230505.002.2023050100">TQ2A.230505.002.2023050100</a> (Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2023042900 release:</p><ul><li>full 2023-05-01 security patch level</li><li>full 2023-05-05 security patch level</li><li>rebased onto TQ2A.230505.002 release</li><li>GmsCompatConfig: update to </li></ul></article></section>