Official releases of GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.https://grapheneos.org/releases#2024060500<section id="changelog" morss_own_score="6.559377178712526" morss_score="581.9633262681497"><h2><a href="https://grapheneos.org/releases#changelog">Changelog</a></h2><p>List of tagged releases. Snapshot releases without tags such as early releases of the project and early device support releases are not listed.</p><p>The changelog is also available as an <a href="https://grapheneos.org/releases.atom">atom feed</a> usable in any standard feed reader.</p><p>The <a href="https://grapheneos.org/history/legacy-changelog">legacy changelog page</a> has the release notes from before the rebranding of the project in 2018 and 2019.</p><article><h3><a href="https://grapheneos.org/releases#2026110100">2026110100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026110100">2026110100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026102100 release:</p><ul><li>add working support for satellite-based cellular service avoiding the previous issues which caused Android Auto to be partially broken due to malfunctioning APIs (confirmed to work with the T-Satellite service from T-Mobile)</li><li>disable buggy defer_service_restart_when_frozen flag due to it breaking handling of service restarts for frozen service clients</li><li>run previously missed post-spawning cleanup for secure (exec) spawning with the native zygote to avoid leaving signals blocked (in practice, this is only used by a subset of Chromium-based browsers including Vanadium to spawn sandboxed renderers as more lightweight native processes and will also be used for the WebView soon)</li><li>SystemUI: fix an upstream Android use-after-free bug in PipTouchHandler</li><li>add fix for remote denial of service vulnerability from the November 2026 security bulletin to the regular releases which has been fixed in our security preview releases since July 2026</li><li>Sandboxed Google Play compatibility layer: fix an IThirdPartyPayService GmsCore crash</li><li>Launcher: fix upstream bug breaking home screen accessibility actions</li><li>kernel (6.18): fix compatibility issues between slab canaries and sheaf allocation added in 6.18</li><li>kernel (6.18): re-enable AutoFDO function splitting optimization since both clang and rustc include the necessary LLVM bug fix for it which was missing for the Android 6.12 kernel toolchain</li><li>kernel (6.18): use the Rust implementation of Binder instead of the legacy C implementation</li><li>kernel (6.18): switch lockdown for the main Android kernel to integrity mode since DMA-BUF statistics now use a BPF program incompatible with confidentiality mode instead of the now deprecated sysfs interface compatible with it (microdroid kernel still uses confidentiality mode)</li><li>kernel (6.18): selinux: add initialized check to security_sid_to_context_type_core to guard against a theoretical issue</li><li>kernel (6.18): fix upstream block-layer races causing kernel crashes and incorrect I/O statistics</li><li>kernel (6.18): fix upstream pKVM IOMMU allocation and retry handling bugs, including a hang during recovery sideloading</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): port all the drivers to the 6.18 kernel branch and switch to it</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream bug breaking recovery from cellular radio boot failures</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream pKVM/SMMU bugs in DMA mapping, error handling and timeout detection</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream memory lifetime bugs in interconnect, CPM tracing and subsystem crash dump drivers</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream initialization, cleanup and error handling bugs in USB charging, display, touch, input, TPU and SoC information drivers</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream callback lifetime bugs in UFS, battery monitoring and modem drivers during initialization failure and cleanup</li><li>kernel (Pixel): stop building with LTO since kCFI doesn't require it, the Pixel OS stopped using it and it's incompatible with newer kernel branches due to Rust + BTF + LTO not being supported together</li><li>kernel (6.1, 6.6, 6.12, 6.18): fix handling edge cases for GrapheneOS SELinux extension auditing code</li><li>kernel (6.1, 6.6, 6.12, 6.18): backport patch for CVE-2026-98432 (MPTCP was already disabled in all of the kernels along with having defenses including MTE)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.182</li><li>kernel (6.1): backport 6 patches from later LTS releases to fix regressions caused by the currently included LTS patches</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.97</li><li>kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.38</li><li>kernel (generic): enable stamping build with Git commit metadata as is already done for Pixel and microdroid kernel builds</li><li>add explicit preloading of Build.VERSION in the zygote process as a replacement for the SELinux policy change in the <a href="https://grapheneos.org/releases#2026102100">previous release</a> fixing Cuttlefish</li><li>revert marking CredentialSelectorActivity opaque as an added GrapheneOS security protection due to app compatibility issues</li><li>Sandboxed Google Play compatibility layer: revert marking FIDO activities as opaque as an added GrapheneOS security protection due to app compatibility issues</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/37">version 37</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/17">version 17</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/18">version 18</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/156.0.8078.73.0">version 156.0.8078.73.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/156.0.8078.79.0">version 156.0.8078.79.0</a></li><li>TalkBack: update to <a href="https://github.com/GrapheneOS/TalkBack/releases/tag/23">version 23</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-178">version 178</a></li><li>Thread network: grant network access to the HAL and simulated Radio Co-Processor (RCP) used for testing in Cuttlefish to avoid breaking the tests</li><li>adevtool: process-kernel-tarballs: add support for tarball-per-target format</li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026110101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-49921, CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0197, CVE-2027-0199</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026102100">2026102100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026102100">2026102100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026101600 release:</p><ul><li>Sandboxed Google Play: fix handling of foreground service types to fix certain services crashing with new versions of Play services and Play Store</li><li>Sandboxed Google Play: add missing declaration of gmscompat process to fix installing Google Search App</li><li>remove the active eMudhra ECDSA root certificate due to compromised intermediate certificates (Vanadium received the removal of this root certificate as an out-of-band component update via our servers when it was released for Chrome)</li><li>remove both legacy eMudhra root certificates (this leaves the heavily used active RSA root certificate as the only remaining one and we're considering either removing it or disabling it by default despite other platforms not removing it at this time)</li><li>add built-in app hibernation exemption for Auditor since it removes the scheduled job for remote attestation after 90 days of not opening the app and results in alerts until users open the app again</li><li>add explicit app hibernation exemptions for App Store and System Updater instead of relying on the implicit exemptions received by a system package manager (App Store) and system apps without a launcher activity (System Updater)</li><li>hardened_malloc: eliminate unused space in quarantine arrays to reduce memory usage</li><li>revert hardening for apps with lockscreen activities added in our <a href="https://grapheneos.org/releases#2026101600">previous release</a> due to compatibility issues</li><li>boot animation: add 0.8s interruptible hold for the logo for a total of 1.6s</li><li>boot animation: reduce logo size for Pixel Tablet to 30% of the shorter dimension from 40%</li><li>boot animation: replace the last use of smoothstep for easing into the loop with smootherstep</li><li>adevtool: backport Android 17 QPR2 Beta 7.1 mmap readahead configuration as a replacement for our kernel change removing it</li><li>kernel (Pixel): undo mmap readahead change replaced by a userspace change disabling both features</li><li>kernel (6.1, 6.6, 6.12, 6.18): backport additional upstream security patches not yet included in the GKI LTS branches</li><li>kernel (6.12, 6.18): update to latest GKI LTS branch revision</li><li>kernel (6.12, 6.18): fix mishandling of ramoops parameter with lockdown mode</li><li>kernel (6.12, 6.18): fix compatibility of slab canaries with KASAN for Cuttlefish</li><li>kernel (6.18): add back linear map randomization downstream with it depending on memory hotplug being disabled at build time which is the case for GrapheneOS kernels since it's an unused feature</li><li>kernel (6.18): microdroid: disable unused memory hotplug</li><li>switch microdroid from Linux 6.6 to Linux 6.18 by default</li><li>switch emulator builds from Linux 6.12 to Linux 6.18 by default and only provide 6.18 prebuilts</li><li>switch emulator builds to using the the standard generic kernel prebuilts used by Cuttlefish instead of dedicated emulator builds since it's exactly the same set of files for GrapheneOS</li><li>switch Cuttlefish builds from Linux 6.12 to Linux 6.18 by default and only provide 6.18 prebuilts</li><li>add missing GrapheneOS components to generic builds used for Cuttlefish targets</li><li>SELinux policy: add missing property labels for Cuttlefish</li><li>scale hardening test timeouts based on hardware timeout multiplier to avoid timeouts for slow targets such as arm64 Cuttlefish relying on instruction emulation</li><li>prefer host rendering for Cuttlefish to work around JIT compilation being blocked on GrapheneOS</li><li>mesa: fix deadlock for gfxstream with Cuttlefish using host rendering</li><li>fix Cuttlefish host rendering on headless hosts without a physical GPU for the system Vulkan driver</li><li>fix Cuttlefish boot without Bluetooth being enabled by default</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/156.0.8078.47.0">version 156.0.8078.47.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-177">version 177</a></li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026102101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026101600">2026101600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026101600">2026101600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026100600 release:</p><ul><li>Sandboxed Google Play: switch from RpcProvider to service bindings and broadcasts to handle new versions of Play services</li><li>Sandboxed Google Play: improve handling of Play Store install confirmation dialogs</li><li>Launcher: update configurations and resources to match Pixel Launcher</li><li>expand Sensors permission to custom sensor types added by devices which includes temperature, pressure and proximity sensors for Pixels in practice</li><li>WindowManagerService: fix upstream Android vulnerability from PID and UID parameter mixup</li><li>Settings: show adaptive connectivity setting for controlling the default enabled connectivity heuristics</li><li>prevent resuming activities hidden by the lockscreen after an activity finishes to resolve an upstream security weakness</li><li>adevtool: fix NFC/eSE/eSIM firmware updates on 9th generation Pixels (this issue started with the October 2026 update and earlier firmware versions applied fine without this)</li><li>add back disabling of preloading graphics driver for secure (exec) spawning</li><li>new GrapheneOS boot animation</li><li>enable multi-display boot animation feature to display it on the outer display of folding devices too</li><li>fix upstream bug resulting in the boot animation on the outer display of folding devices stalling due to display configuration in the late boot process (this is likely why AOSP and the stock Pixel OS still don't display a boot animation on the outer display)</li><li>Pixels: update to October 2026 kernel drivers which was delayed due to ongoing lack of GPLv2 compliance by Google (none of the security patches listed in the October 2026 Pixel Update Bulletin are in the kernel drivers for 6th through 10th gen Pixels)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.96</li><li>kernel (6.18): update to latest GKI LTS branch revision</li><li>update timezone data to 2026e</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/155.0.8059.39.0">version 155.0.8059.39.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/155.0.8059.79.0">version 155.0.8059.79.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/155.0.8059.84.0">version 155.0.8059.84.0</a></li><li>TalkBack: switch to standalone app signing key</li><li>fix benign CtsWindowManagerDeviceKeyguard:KeyguardLockedTests test failures caused by the 2nd factor PIN entry being focusable during creation of the user interface</li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026101600 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59069</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026100600">2026100600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026100600">2026100600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026100200 release:</p><ul><li>full 2026-10-05 security patch level</li><li>Pixels: update to October 2026 firmware and HALs</li><li>fix upstream integer overflow bug in ZipFileRO.cpp causing memory corruption with a 65,535 byte entry name</li><li>use speed compiler filter for all system_server JARs and non-APEX APKs instead of using speed-profile when a profile exists (improves core OS performance)</li><li>Contacts: don't offer local accounts for new labels when default account is cloud</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.94</li><li>kernel (6.18): update to latest GKI LTS branch revision</li><li>kernel (6.6, 6.12, 6.18): change approach to disabling Android's vendor hooks for INIT_ON_FREE to avoid conflicts</li><li>Seedvault: migrate to the latest upstream Android 17 branch from our own port to Android 17 to get the latest upstream improvements</li><li>Seedvault: implement downstream fixes for a bunch of bugs and user interface deficiencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.126.0">version 154.0.8037.126.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-176">version 176</a></li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026100601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59066, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026100200">2026100200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026100200">2026100200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026092500 release:</p><ul><li>kernel (Pixel): restore Android 17 (CP2A) mmap read-ahead behavior to resolve stuttering due to memory pressure caused by an upstream Pixel kernel change in Android 17 QPR1</li><li>disable unprivileged hardware keepalives since it creates a VPN leak</li><li>raise listed security patch level to 2026-09-05 since we've already had the 2026-09-05 Android security patch level for a while and have all the Pixel firmware/driver updates from Android 17 QPR1 since the last release</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.144</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.33</li><li>fix upstream Android bug causing last modified time being set incorrectly for files restored from Android backups due to it passing seconds to an API taking milliseconds (files had last modified time set to January 1970)</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/13">version 13</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/14">version 14</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/15">version 15</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/16">version 16</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.92.0">version 154.0.8037.92.0</a></li><li>adevtool: add command for processing Pixel kernel tarballs</li><li>arcslib: add support for system_ext overlays</li><li>apksig: handle APKs that lack a V3 signature in print-certs command</li><li>add ColdFileReadBenchmark to benchmark cold mmap reads with low free swap</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026100201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58820, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59059, CVE-2026-59063</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026092500">2026092500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026092500">2026092500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026091900 release:</p><ul><li>Pixels: fully update kernel drivers, firmware and userspace hardware support code to Android 17 QPR1 by adding infrastructure to support it on Android 17</li><li>add back SIM PIN scrambling toggle in the new Protect SIM card screen</li><li>Settings: improve user interface for the secure paste feature controlling clipboard access</li><li>adevtool: restore the Cape modem carrier override for 6th generation Pixels since Google didn't include it</li><li>adevtool: reclaim storage space reserved for preloaded AI models used by the stock Pixel OS on 10th/11th gen Pixels</li><li>bionic libc: add missing stack size calculation overflow check (no real world impact)</li><li>bionic libc: revert legacy change removing VLA due to -fstack-clash-protection making it safe for a while now (fixes an issue with Bionic trace markers)</li><li>Sandboxed Google Play: add CLOEXEC to zip file descriptors created with dup for sandboxed Google Play services dynamite modules in ART, bionic and libcore (no real world impact)</li><li>hardened_malloc: optimize slab quarantine indexing by limiting slab quarantine length multipliers to a power of two (both multipliers are set to the default of 1)</li><li>hardened_malloc: optimize aligned size class calculation</li><li>hardened_malloc: optimize size class struct layout</li><li>hardened_malloc: add missing "cc" to clobber list for MTE assembly (bug inherited from LLVM with no real world impact)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-175">version 175</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.57.0">version 154.0.8037.57.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.57.1">version 154.0.8037.57.1</a></li><li>add scripts for automating building kernels and updating the builds included in the OS source tree</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026092501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026091900">2026091900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026091900">2026091900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026091700 release:</p><ul><li>Pixels: backport CarrierSettings from Android 17 QPR1 to resolve carrier compatibility issues caused by the modem firmware backport</li><li>Pixels: backport wfc-pkt-router from Android 17 QPR1 to resolve a crash</li><li>reduce rate limit for notifying about clipboard reads blocked by our secure paste feature from 1 minute to 6 seconds since users can toggle off the notice on a per-app basis if it's an annoyance</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.52.0">version 153.0.8010.52.0</a></li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054</li><li>Unclassified: CVE-2026-58994</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026091700">2026091700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026091700">2026091700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026091000 release:</p><ul><li>Pixels: backport cellular modem firmware from Android 17 QPR1</li><li>add per-app toggle for disallowing apps reading the clipboard with a global toggle to make it the default (forces pasting via the OS selection toolbar, keyboard apps, keyboard shortcuts or accessibility services)</li><li>Keyboard: add paste chip to offer pasting recently copied content when there's nothing else to show as an option</li><li>Dialer: default to the contact opt-out mode for users enabling automatic call recording for the first time rather than opt-in</li><li>update timezone data to 2026c</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.177</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.143</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.93</li><li>add 6.18 kernel branch</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.47.0">version 153.0.8010.47.0</a></li><li>adevtool: improve the process-bulletin-patches command</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054</li><li>Unclassified: CVE-2026-58994</li></ul><p>Other changes in the 2026091701 security preview release:</p><ul><li>fix upstream bug breaking sending MMS from secondary users</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026091000">2026091000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026091000">2026091000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026090700 release:</p><ul><li>full 2026-09-01 security patch level</li><li>Contact Scopes: improve compatibility with certain apps</li><li>Dialer: add the option to enable call recording for every contact by default with a list of excluded numbers</li><li>Dialer: declare microphone and phone foreground service type to fix automatic call recording for answering calls via Bluetooth</li><li>SystemUI: respect lockscreen media setting on always-on display</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-174">version 174</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.36.0">version 153.0.8010.36.0</a></li><li>adevtool: improve the apply-bulletin-patches command and rename it to process-bulletin-patches</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091001 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032</li><li>Unclassified: CVE-2026-58994</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026090700">2026090700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026090700">2026090700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026090500 release:</p><ul><li>dismiss app drawer keyboard before private space unlock to fix private space search credential prompt text disappearing on secondary users</li><li>hardened_malloc: update libdivide to 5.4.0</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55260, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55274, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59032</li><li>Unclassified: CVE-2026-58994</li></ul><p>Other changes in the 2026090701 security preview release:</p><ul><li>fix security preview patch breaking the volume bar button for displaying the rest of the volume controls</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026090500">2026090500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026090500">2026090500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026081300 release:</p><ul><li>Launcher: filter Private Space apps from search while it's locked to resolve upstream privacy deficiency (Pixel Launcher delegates search to Android System Intelligence which fixed this already)</li><li>Launcher: add "Private Space" action for unlocking the Private Space to app drawer search to match the Pixel Launcher</li><li>Launcher: fix upstream crash on large-screen devices when opening a folder from the taskbar with 3-button navigation</li><li>Settings: add warning about the standard Android feature for hiding Private Spaces only being superficial and having multiple known tricks for detecting it</li><li>Dialer: add support for automatic call recording with a per-call opt-out switch for both incoming and outgoing calls along with a notice of automatic call recording being active during calls</li><li>backport upstream Android 17 QPR1 Beta 5 fix for widgets disappearing after reboot</li><li>exempt DocumentsUI from redaction of location metadata to resolve upstream bug causing the system file manager to redact location metadata for copies or certain moves</li><li>Settings: initialize display color mode to the correct default value to resolve remaining issues with switching back to the default color mode for Pixels caused by an upstream bug not currently impacting the stock Pixel OS</li><li>adevtool: remove Saturated color options from devices where it isn't properly supported</li><li>Sandboxed Google Play compatibility layer: fix PackageInstaller.installPackageArchived() stub</li><li>hardened_malloc: replace MADV_DONTNEED with MADV_DONTNEED_LOCKED to improve compatibility with mlockall</li><li>hardened_malloc: enforce success for MADV_DONTNEED_LOCKED to avoid the need for a memory clearing fallback path</li><li>hardened_malloc: avoid unnecessary purging end guard for shrinking large allocations</li><li>hardened_malloc: replace MAP_FIXED and fix MREMAP_FIXED ENOMEM handling to fix extreme out-of-memory edge cases where these unmap the target but fail to replace it</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): update to latest upstream kernel driver sources (replaces our manual backport of CVE-2026-0163)</li><li>kernel (6.6, 6.12): add workaround for an upstream arm64 KVM bug breaking booting with lockdown in confidentiality mode (this was previously only applied for a variant of the 6.6 branch specific to 10th gen Pixels but is more broadly applicable)</li><li>kernel (6.6): fix edge case error handling for missing SELinux policy in our extensions to SELinux</li><li>kernel (6.12): AutoFDO: disable machine function splitting due to an incompatibility with BTI which is enabled by GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.42.0">version 152.0.7977.42.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.54.0">version 152.0.7977.54.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.64.0">version 152.0.7977.64.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.84.0">version 152.0.7977.84.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-173">version 173</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/8">version 8</a></li><li>adevtool: add support for unpacking optimized GrapheneOS factory images</li><li>adevtool: add an option to use stock OS kernel files for testing purposes</li><li>adevtool: improve the apply-bulletin-patches command</li><li>Launcher: fix Launcher3QuickStepTests for Android 17</li><li>SELinux policy: remove workaround no longer required by our current secure spawning implementation</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55260, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55274, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59032</li><li>Unclassified: CVE-2026-58994</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026081300">2026081300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026081300">2026081300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026080500 release:</p><ul><li>Bluetooth: handle nested secondary profiles when sending broadcasts to fix support for wireless Android Auto in nested secondary profiles (Private Spaces and work profiles)</li><li>enable multiuser-unaware API usage warnings for Bluetooth processes</li><li>Contact Scopes: use identity of the calling app for the filtered query since the query validation, projection mapping, etc. depend on the target SDK version of the calling app (this is a proper solution to the Contact Scopes compatibility issues for WhatsApp and sandboxed Google Play services in Android 17 replacing our previous workaround)</li><li>CredentialManager: make CredentialSelectorActivity opaque (avoid showing activity underneath) to resolve security vulnerabilities not yet fixed upstream</li><li>Sandboxed Google Play compatibility layer: mark all Play services FIDO activities as opaque (avoid showing activity underneath) to resolve Play services security vulnerabilities not yet fixed upstream</li><li>Sandboxed Google Play compatibility layer: prevent the Play services from being frozen by the cached app freezer by binding to the persistent process from GmsCompat (this resolves Firebase Cloud Messaging delays)</li><li>Sandboxed Google Play compatibility layer: fix race conditions in GLocationService.flushLocations() and PersistentFgService.requestStart() to avoid crashes in edge cases</li><li>Sandboxed Google Play compatibility layer: add special handling for Android Auto OutOfCarLifecycle crashes to avoid getting issue reports for expected uncaught exceptions from Android Auto connectivity loss</li><li>Sandboxed Google Play compatibility layer: only notify about missing Notifications permission for Play services since other components such as the Play Store handle it themselves</li><li>Sandboxed Google Play compatibility layer: switch privSettingsPutStrings() to StringParceledListSlice to handle larger arrays</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.176</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.83.0">version 151.0.7922.83.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.108.0">version 151.0.7922.108.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.137.0">version 151.0.7922.137.0</a></li><li>adevtool: improve the apply-bulletin-patches command</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026081301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979</li><li>Unclassified: CVE-2026-55260, CVE-2026-58883</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026080500">2026080500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026080500">2026080500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026072900 release:</p><ul><li>full 2026-08-05 Pixel security patch level</li><li>update to August 2026 Pixel driver/firmware code</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): apply fix for CVE-2026-0163</li><li>Contact Scopes: add a workaround for WhatsApp ACCOUNT_TYPE queries to resolve an incompatibility introduced with Android 17</li><li>Sandboxed Google Play compatibility layer: retain RPC provider connection for out-of-memory adjustment</li><li>backport Android 17 QPR1 fix for Bluetooth developer options confirmation</li><li>kernel (6.1, 6.6, 6.12): backport patch for CVE-2026-64560</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.71.0">version 151.0.7922.71.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/91">version 91</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/92">version 92</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/93">version 93</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/33">version 33</a></li><li>adevtool: add command for removing unused device images</li><li>adevtool: improve the apply-bulletin-patches command</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026080501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58957, CVE-2026-58958</li><li>Unclassified: CVE-2026-55260, CVE-2026-58883, CVE-2026-58935</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026072900">2026072900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026072900">2026072900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026071500 release:</p><ul><li>extend per-app opt-out for hardened_malloc and extended virtual address space to child processes to support working around rare app compatibility issues involving separate native processes run by an app</li><li>override previous SELinux context for secure (exec) spawning to fix compatibility with anti-tampering libraries checking for it</li><li>ContactsProvider: fix upstream Android security vulnerability</li><li>Telephony: fix upstream Android security vulnerability caused by missing system permission check for apps with API levels below 30</li><li>adevtool: include feature flags for Pixel NFC/eSE/eSIM firmware updater to avoid deviating from the stock OS</li><li>work around upstream bug for original-package renaming to resolve crashes with Vanadium on OS installs from 4-5 years ago when using the native zygote (we had to temporarily turn off javaless renderers in Vanadium Config 192 and will re-enable it after this OS release)</li><li>libpng: backport upstream security patches</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.175</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.142</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.92</li><li>improve GrapheneOS package state infrastructure to fix minor rare non-serious bugs</li><li>replace our workarounds for pseudo-locale crashes with a proper fix for the issue</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.29.0">version 151.0.7922.29.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.47.0">version 151.0.7922.47.0</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/7">version 7</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-172">version 172</a></li><li>add a way to use any WebView provider on OS debug builds</li><li>fix pointer aliasing in malloc dispatch tables to fix malloc debug functionality in certain cases</li></ul><p>All of the Android 17 security patches from the current August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026072901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58868, CVE-2026-58869, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260, CVE-2026-58820, CVE-2026-58883, CVE-2026-58935</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026071500">2026071500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026071500">2026071500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026071100 release:</p><ul><li>Secure (exec) spawning: skip vkey.android.vos.VosZygotePreload to make exec-based spawning compatible with apps using V-KEY V-OS Mobile App Protection</li><li>Secure (exec) spawning: skip redundant mount namespace setup for compatibility with anti-tampering code checking Linux mount IDs</li><li>start compat zygote at boot instead of on-demand for compatibility with anti-tampering code checking Linux mount IDs (compat zygote is only used when both secure spawning and hardened_malloc are disabled for an app)</li><li>use lazy preloading for compat zygote to reduce memory usage when it's not used (it's only used for app processes which disable both hardened_malloc and secure spawning)</li><li>install CarrierConfig2 in all profiles to avoid using default carrier configuration values in secondary users</li><li>notify when Wi-Fi hotspot is disabled due to user change (since users have separate Wi-Fi settings since Android 17) to provide a shortcut for turning it back on via the notification</li><li>remove our change raising the zygote's maximum file limit to 256Ki since this has been implemented upstream as a 512Ki limit with correct handling for 32-bit processes</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): integrate minor upstream synopsys driver change unrelated to security</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.141</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.124.0">version 150.0.7871.124.0</a></li><li>add secure spawning file descriptor regression test</li></ul><p>All of the Android 17 security patches from the current August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026071501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58868, CVE-2026-58869</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260, CVE-2026-58820</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026071100">2026071100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026071100">2026071100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026070500 release:</p><ul><li>replace secure (exec) spawning feature with a new implementation with improved app compatibility and a per-app toggle replacing the previous global toggle</li><li>extend exec spawning feature to the native zygote added in Android 17</li><li>raise listed security patch level to 2026-07-05 security patch level which has no additional patches listed in either the Android or Pixel bulletin</li><li>update to July 2026 Pixel driver/firmware code</li><li>fix upstream bug in multi-user handling for the WifiService package state listener which among other possible issues was causing wireless Android Auto compatibility issues in secondary users</li><li>fix upstream bug in RemoteException handling for GeocodeProviderBase causing exceptions between the geocoding service and client app to crash the geocoding service</li><li>fix external display mirroring in secondary users (upstream bug)</li><li>fix handling of multiple users for screen recording (upstream bug)</li><li>Sandboxed Google Play compatibility layer: add MODIFY_PHONE_STATE to the special Android Auto phone call permissions toggle since it's needed for managing phone calls in recent versions</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.140</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.90</li><li>bionic libc: fix API level check for %#m format string (upstream bug)</li><li>update_device.py: improve the experience of testing updates on debug builds by avoiding restarting ADB as root</li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/32">version 32</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.114.0">version 150.0.7871.114.0</a></li></ul><p>All of the Android 17 security patches from the current August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026071101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49933</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55258, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026070500">2026070500</a></h3><p>Users solely doing offline updates via recovery mode sideloading need a <a href="https://discuss.grapheneos.org/d/37947-special-sideload-only-android-16-qpr2-release-fixing-sideloading-to-android-17">special sideload-only release</a> to update from Android 16 QPR2 to Android 17. This release fixes upstream bugs for sideloading present in Android 16 QPR2 which prevented updating to Android 17 unless the OS images were far larger than the GrapheneOS ones which triggers a fallback path avoiding the issue.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026070500">2026070500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062800 release:</p><ul><li>rebuild coarse locations from allowlisted fields to resolve an upstream Android privacy flaw leaking secondary fields such as altitude and accuracy to apps without precise location granted</li><li>System UI:: run scroll capture tile handling on main thread to fix an upstream race condition causing memory corruption</li><li>Launcher: fix removing space for the quick search bar to avoid removing padding at the bottom</li><li>fix PIN scrambling for Private Spaces configured to use parent credentials</li><li>implement enhanced PIN privacy for the new PIN pad used outside of the lockscreen</li><li>fix handling of TEXT_SHOW_PASSWORD to split TEXT_SHOW_PASSWORD_TOUCH TEXT_SHOW_PASSWORD_PHYSICAL in Android 17</li><li>backport security patches for FreeType</li><li>kernel (6.1, 6.6, 6.12): fix upstream double-free bug in USB gadget Ethernet driver which was caught by hardware memory tagging in GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.1, 6.6, 6.12): backport fixes for CVE-2026-46242</li><li>enable precompiling dex bytecode for Vanadium now that the Trichrome Library APK no longer breaks compatibility with it (shared library APKs are incompatible with precompilation and this is the only one in the OS)</li><li>Theme Picker: replace references to apps not included in GrapheneOS to avoid black icons</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.63.0">version 150.0.7871.63.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.63.1">version 150.0.7871.63.1</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026070501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49933</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55258, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062800">2026062800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062800">2026062800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062300 release:</p><ul><li>add setting for controlling Certificate Transparency (CT) log list downloads used for apps enforcing CT which is enabled by default for apps targeting Android 17+ with a choice between GrapheneOS (default), Standard (previous behavior) and Off</li><li>enable register_bluetooth_receiver_for_all_users feature flag to fix Bluetooth telecom functionality in secondary users (resolves an upstream regression in Android 17)</li><li>temporarily use absolute media profile XML paths to work around an exec-based spawning compatibility issue breaking WhatsApp functionality which will be properly addressed by our upcoming overhaul to exec-based spawning</li><li>add native zygote support to handle Chrome using it and for future use in Vanadium once exec spawning is ported to it</li><li>build wpa_supplicant_mainline from source since it's used instead of the vendor wpa_supplicant on the Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold</li><li>fix NFC quick tile state not updating in secondary users</li><li>Settings: fix lifecycle of the added NFC state listener to avoid crashes for the Connection preferences page in edge cases</li><li>Settings: fix minor regression losing listing the duress password feature as being one of the settings available in the screen lock menu which helps people discover the feature</li><li>Sandboxed Google Play compatibility layer: add stub for PackageInstaller.installPackageArchived()</li><li>Sandboxed Google Play compatibility layer: use fresh file proxy file descriptors for app opens to fix compatibility issues</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix another upstream out-of-bounds array read caught by hardware memory tagging in the DisplayPort driver caused by devices implementing the DisplayPort protocol incorrectly and the kernel driver not properly handling the incorrect data</li><li>don't report harmless ExynosDevice::dynamicRecompositionThreadLoop crash</li><li>Seedvault: grant local network access to fix local network usage for backups with Android 17</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.197.0">version 149.0.7827.197.0</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/7">version 7</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49921</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49924</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062300">2026062300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062300">2026062300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062200 release:</p><ul><li>fix serious upstream Android VPN race condition resulting in the always-on VPN being disabled in edge cases including VPN app updates</li><li>fix Bluetooth auto-off in secondary users for Android 17</li><li>Sandboxed Google Play compatibility layer: resolve ThermalManagerService droidguard incompatibility causing RCS to break after droidguard is updated</li><li>Sandboxed Google Play compatibility layer: increase log level of maybeInterceptBinderProxyDump() to help with debugging droidguard checks</li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062200">2026062200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062200">2026062200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062100 release:</p><ul><li>change the behavior of pressing the new Android 17 Wi-Fi quick tile to disabling Wi-Fi instead of only pausing it by disconnecting from the current network and not actively connecting to another automatically</li><li>backport upstream fix for recovery mode sideloading to replace the workaround we included in our initial public Android 17 release (this will needed to be backported to Android 16 QPR2 to provide a sideload upgrade path)</li><li>Sandboxed Google Play compatibility layer: add local network access to the permissions added by the wireless Android Auto toggle since it's often required</li><li>Sandboxed Google Play compatibility layer: add stub for NsdManager.registerService() to handle lack of ACCESS_LOCAL_NETWORK</li><li>enable photopicker in Wallpaper Picker app to restore photo picker functionality from before Android 17</li><li>Wallpaper Picker: add vertical padding to the "Choose a photo" button</li><li>Launcher: fix hidden workspace app labels on non-responsive grids</li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062100">2026062100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062100">2026062100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026061800 release:</p><ul><li>disable MTE for Widevine Rikers service since it's incompatible with it (issue predates Android 17)</li><li>Sandboxed Google Play compatibility layer: avoid opening extra file descriptions to obtain Play services data prefix paths to avoid a compatibility issue with anti-tampering code used by the Kia Connect app and likely others (issue predates Android 17)</li><li>separate GrapheneOS framework resource IDs from AOSP resource IDs to avoid incompatibilities with Pixel vendor components (issue predates Android 17)</li><li>kernel (Pixel 10): fix for an upstream Broadcom Wi-Fi bcm4383 driver memory corruption bug to avoid invalid memory accesses caught by the kernel hardware memory tagging enabled by GrapheneOS</li><li>disable UBLK feature flag for over-the-air updates due to it likely causing update reliability issues for devices with support for it (6.6 kernel or newer)</li><li>disable UBLK for generated over-the-air update packages to force disable it for updates from the initial Android 17 release</li><li>increase the maximum size of log events in production builds to match debug builds to avoid the kernel panic message and traceback being cut off</li><li>use DevicePolicyManager.MAX_PASSWORD_LENGTH PIN length limit for the new upstream SystemUI PIN user interface for entering the PIN outside of the lockscreen to fix support for the expanded limit of 128 on GrapheneOS instead of using Android's limit of 16 (this didn't apply to passwords and it was straightforward to work around it by changing the PIN to a password)</li><li>Settings: show night light settings even when Pixel Comfort View is enabled since we're missing the settings for it (currently only relevant to the 10th gen Pixels other than the Pixel 10a)</li><li>allow using the new flashlight quick tile while locked (GrapheneOS requires unlocking by default for system quick tiles)</li><li>SystemUI: avoid crashing when trying to edit a screen recording without a video editor app</li><li>fix upstream bug causing the security scan in the Settings app to take much longer in Android 17 (also impacts the stock OS)</li><li>fix compatibility issue breaking resetting permissions for apps with special-runtime permissions (Nearby Devices is now split to have Local Network access enabled by default for compatibility for apps not targeting Android 17 and there are bugs with how this is handled)</li><li>Launcher: remove quick search bar from showing on large display devices since Android 17</li><li>Launcher: remove space reserved for the quick search bar since Android 17</li><li>add Pixel Comfort View settings for supported devices (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold)</li><li>add back error message for entering an incorrect 2nd factor PIN for the GrapheneOS 2-factor fingerprint unlock feature</li><li>fix compatibility with the native zygote spawning system added by Android 17 which isn't enabled yet (this was added to provide more lightweight sandboxed renderer processes for Chromium and will benefit Vanadium even more due to having finer-grained process isolation but isn't used by Chromium/Chrome yet and our secure spawning will need to be ported to it)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-171">version 171</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026061800">2026061800</a></h3><p>This is the initial release of GrapheneOS based on Android 17.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026061800">2026061800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026061600 release:</p><ul><li>full 2026-06-05 Pixel security patch level (released with Android 17)</li><li>rebased onto CP2A.260605.016 Android Open Source Project release (Android 17)</li><li>add workaround for upstream bug breaking using recovery mode sideloading for updating to Android 17 releases</li><li>revert in-process Opus codec sandboxed with LFI (Lightweight Fault Isolation) to dedicated sandboxed process in order to restore compatibility with hardware memory tagging and avoid likely holes in LFI</li><li>Sandboxed Google Play compatibility layer: add stubs for BluetoothLeBroadcast methods</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.159.0">version 149.0.7827.159.0</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026061801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026061600">2026061600</a></h3><p>This is our final release based on Android 16 QPR2/QPR3 since we've completed our initial port to Android 17 and are resolving regressions to prepare it for a public release very soon.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026061600">2026061600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026060600 release:</p><ul><li>skip replacing pairip Play Store installer check with Play Store source stamp checks for apps installed directly from the Play Store where the check will pass to avoid causing compatibility issues for apps with deeper pairip integration</li><li>hardened_malloc: add support for Cuttlefish build targets</li><li>Network Location: require TLSv1.3 for Apple and Apple China location services in addition to the GrapheneOS service</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.174</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.102.0">version 149.0.7827.102.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.114.0">version 149.0.7827.114.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-170">version 170</a></li><li>Speech Services: update to <a href="https://github.com/GrapheneOS/SpeechServices/releases/tag/3">version 3</a></li></ul><p>All of the Android 16 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026061601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-0054, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0084, CVE-2026-28572, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28670, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026060600">2026060600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026060600">2026060600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026060100 release:</p><ul><li>Launcher: fix upstream bug causing the recents button to become unresponsive for users with third party launchers</li><li>replace validation of Play Store source stamps with a correct implementation (this isn't yet used for security-sensitive purposes but we plan to begin using it to replace security-relevant Play Store source checks in the near future)</li><li>replace implementation of using Play Store source stamps as a substitute for Play Store installer checks included as part of Play Store anti-tampering protection enabled by certain apps (this prevents using the apps when combined with the Play Integrity API store lising toggles)</li><li>Settings: correctly reset tethering offload developer setting when disabling developer options</li><li>Settings: add one-time reset of tethering offload developer setting to re-enable it for everyone who had it disabled by the upstream Android bug when disabling developer options</li><li>Settings: fix upstream null pointer exception bug in SettingsBasePreferenceFragment when listView is null which occurs with at least one of the developer options</li><li>Pixel 10a: add missing SELinux policy for Pixel Camera TPU usage</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.59.0">version 149.0.7827.59.0</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/5">version 5</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/6">version 6</a></li></ul><p>All of the Android 16 security patches from the current July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026060601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662</li><li>High: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-0054, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0084, CVE-2026-28572, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28667, CVE-2026-28668, CVE-2026-28670, CVE-2026-28671</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026060100">2026060100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026060100">2026060100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026052400 release:</p><ul><li>full 2026-06-01 security patch level</li><li>fix Location access indicator to always properly display when only coarse location is granted too</li><li>kernel (Pixel): fix upstream use-after-free bug in Broadcom Wi-Fi driver caught by hardware memory tagging</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream out-of-bounds array read caught by hardware memory tagging in the DisplayPort driver caused by devices implementing the DisplayPort protocol incorrectly and the kernel driver not properly handling the incorrect data</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.89</li><li>Speech Services: update to <a href="https://github.com/GrapheneOS/SpeechServices/releases/tag/2">version 2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.48.0">version 149.0.7827.48.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/92">version 92</a></li></ul><p>All of the Android 16 security patches from the current July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026060101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662</li><li>High: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-0054, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0084, CVE-2026-28572, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28667, CVE-2026-28668, CVE-2026-28670, CVE-2026-28671</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026052400">2026052400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026052400">2026052400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050900 release:</p><ul><li>add GrapheneOS Speech Services providing a local text-to-speech engine using a model trained by GrapheneOS with fully open source code and training data</li><li>set GrapheneOS TalkBack as the default accessibility service to support easily enabling it via the accessibility shortcut</li><li>Network Location: position estimation algorithm overhaul to improve accuracy, reliability and especially the consistency of results along with improving reporting the estimated accuracy</li><li>Sandboxed Google Play compatibility layer: add stub for NetworkStatsManager.queryDetailsForUidTag()</li><li>Sandboxed Google Play compatibility layer: stub CarrierConfigManager.getConfigForSubId for Android Auto</li><li>Keyboard: expand heuristic for working around Jetpack Compose TextField bug</li><li>remove android.hardware.telephony.satellite feature declaration since it's not supported by GrapheneOS and declaring the feature causes minor issues with recent Android Auto releases</li><li>Calculator: fix long click to paste not working on first run</li><li>Seedvault: allow new content provider for DAVx⁵ WebDAV provider (will be replaced with a better backup implementation in the future)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.173</li><li>kernel (6.1): update to 6.1.174</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.139</li><li>kernel (6.6): backport security patches for CVE-2026-46300 and CVE-2026-43503 which aren't exploitable for local privilege escalation from non-root on Android due to not permitting unprivileged use of user namespaces</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.88</li><li>kernel (Pixel): fix upstream bug in Samsung TEE DMA heap driver used by the PowerVR and Mali GPU drivers for DRM support causing a crash with kernel hardware memory tagging from it freeing a pointer with the tag stripped</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.167.0">version 148.0.7778.167.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.178.0">version 148.0.7778.178.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.22.0">version 149.0.7827.22.0</a></li><li>set the patch level to 2026-05-05 instead of the officially equivalent 2026-05-01 since no patches were listed for 2026-05-05 for either Android or Pixels but not raising it to the equivalent higher value leads to confusion</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026052401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28658, CVE-2026-28660</li><li>Unclassified: CVE-2026-0075, CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050900">2026050900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050900">2026050900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050700 release:</p><ul><li>kernel (Pixel 8a, Pixel 9a): fix for an upstream Broadcom Wi-Fi bcm4383 driver memory corruption bug to avoid invalid memory accesses caught by the kernel hardware memory tagging enabled by GrapheneOS (the May 2026 Wi-Fi firmware + kernel driver update introduced this issue)</li><li>backport Broadcom Wi-Fi bcm4383 driver changes from CP21.260330.008 (Android 17 Beta 4) to avoid invalid memory accesses (this didn't end up resolving the hardware memory tagging crashes introduced in the May 2026 Pixel update but we kept this to fix additional issues)</li><li>disable buggy upstream IStatusBarNotificationHolder optimization via the upstream feature flag (no_sbnholder) due to it causing occasional system_server crashes from sending overly large Binder transactions</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620</li><li>Unclassified: CVE-2026-28618</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050700">2026050700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050700">2026050700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050600 release:</p><ul><li>update Pixel kernel driver sources to May 2026 (this resolves the Pixel 8a and Pixel 9a issues resulting in the release for those being quickly cancelled after early Alpha testing due to the new firmware requiring driver changes)</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28594, CVE-2026-28596, CVE-2026-28602</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050600">2026050600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050600">2026050600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050400 release:</p><ul><li>update Pixel firmware, driver libraries, HALs and other components backported from Android 16 QPR3 from the initial March 2026 release to the May 2026 release (CP1A.260505.005.A1)</li><li>Contact Scopes: add missing handling for QUERY_DEFAULT_ACCOUNT_FOR_NEW_CONTACTS_METHOD was added in Android 16</li><li>backport fix for stuck IME input from May 2026 Pixel update</li><li>bionic: avoid adding an extra guard page below the main thread's pthread_internal_t since it serves no purpose (the stack is in a dedicated mapping from the kernel so the stack guard is immediately below pthread_internal_t) and it causes a crash for incorrect anti-tampering code shared across many banking apps which reads /proc/self/maps to find the main thread's thread-local data including pthread_internal_t based on mapping name and then tries to access the internal libc data stored in an entirely internal libc format without checking if there's a guard page (these anti-tampering checks serve no valid security purpose, cause these apps to break on major Android releases and hinder OS security hardening due to compatibility issues with their incorrect code)</li><li>bionic: remove unnecessary extra naming for mappings to avoid 2 extra system calls for creating a thread</li><li>adevtool: fix update-carrier-settings command</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28594, CVE-2026-28596, CVE-2026-28602</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050400">2026050400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050400">2026050400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026042100 release:</p><ul><li>full 2026-05-05 security patch level (listed as 2026-05-01 due to 2026-05-05 not being officially defined)</li><li>disable registerQuicConnectionClosePayload optimization to fix VPN leak</li><li>Sandboxed Google Play compatibility layer: add shim for BluetoothAdapter.ACTION_REQUEST_ENABLE</li><li>apply active Dynamic Code Loading restrictions for Java inside isolated processes</li><li>add app API for checking Dynamic Code Loading restriction states</li><li>fully enable lockscreen widget support by default to avoid the swipe gesture being missing for the Pixel 10a and the whole feature being missing for the emulator</li><li>enable standard secure NFC mode by default which can be changed via Settings &gt; Connected devices &gt; Connection preferences &gt; NFC &gt; Require device unlock for NFC (note this only disables card emulation while locked rather than all uses of NFC)</li><li>backport upstream fix for getBubblePackageForLogging() crash</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.170</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.130</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>hardened_malloc: fix slightly non-uniform distribution of random u16 values used for randomizing slot selection, slab allocation quarantining and free slab quarantining</li><li>hardened_malloc: improve the robustness of disabling memory tagging against theoretical issues by making it fork-safe and adding more synchronization to avoid technically undefined parallel reads of the memory tagging state</li><li>hardened_malloc: improve handling of out-of-memory edge cases</li><li>hardened_malloc: improve sized deallocation hardening</li><li>libpng: backport fix for CVE-2026-33636</li><li>bionic: clamp the minimum size of the random guard region we add between the stack and pthread_internal_t (thread-local storage and other sensitive data) for secondary stack randomization to the page size to guarantee we always add a guard page protecting pthread_internal_t from stack buffer overflows</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/36">version 36</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.111.0">version 147.0.7727.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.49.0">version 148.0.7778.49.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.60.0">version 148.0.7778.60.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.60.1">version 148.0.7778.60.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.96.0">version 148.0.7778.96.0</a></li><li>adevtool: add update-gservices-flag command for fetching gservices flags</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28594, CVE-2026-28596, CVE-2026-28602</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026042100">2026042100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026042100">2026042100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040800 release:</p><ul><li>Launcher: backport fix from Pixel Launcher for the recents overview with third party launchers</li><li>Launcher: improve our implementation of hiding the app list when search is focused to more closely match Pixel Launcher</li><li>don't allow irregular secondary users (guest, demo or restricted) to have a private space</li><li>Settings: inherit user restrictions from full user to a nested private space and run a one-time task to add missing restrictions</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.167</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.1): backport SVE support for protected guests</li><li>kernel (6.1, 6.6, 6.12): backport fix for race conditions in USB gadget UVC driver causing crashes with the device as webcam feature including use-after-free detected by hardware memory tagging</li><li>kernel (6.6, 6.12): disable Android GKI vendor hooks for INIT_ON_FREE page zeroing to avoid Pixels deferring zero-on-free for reclaim (kswapd) via their driver tree since it reduces security to improve performance (the stock OS doesn't use INIT_ON_FREE but they tried to reduce the cost to be acceptable for the stock OS while we want the full security instead)</li><li>adevtool: change added Cape cellular radio carrier configuration entry to use USCC (1952) instead of ATT (1187) to avoid outbound call issues for users opting into using their new setup early (stock Pixel OS will add the same entry but they take months to handle it so it was submitted to us too)</li><li>hardened_malloc: improve handling of out-of-memory edge cases</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.101.0">version 147.0.7727.101.0</a></li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026042101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28585, CVE-2026-28586</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040800">2026040800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040800">2026040800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040600 release:</p><ul><li>full 2026-04-05 security patch level</li><li>update Pixel firmware, driver libraries, HALs and other components backported from Android 16 QPR3 from the initial March 2026 release to the April 2026 release (CP1A.260405.005)</li><li>Settings: ProfileSelectFragment: backport Android 16 QPR3 to ease future porting</li><li>Settings: ProfileSelectFragment: fix crash caused by upstream bug when opening credential settings from private profile</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.12): temporarily disable RANDSTRUCT and LTO due to incompatibility with Rust since Android has started using the Rust ashmem rewrite (CFI still works without LTO due to using kCFI)</li><li>kernel (6.12): switch to Rust ashmem implementation</li><li>kernel (6.12): enable building Rust Binder implementation</li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040600">2026040600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040600">2026040600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040300 release:</p><ul><li>full 2026-04-01 security patch level</li><li>make temporary biometric lockouts into permanent lockouts and ensure only framework can clear lockout to make sure our 5 attempt limit is always properly enforced across devices with different implementations of biometric unlock instead of batches of 5 temporary lockouts followed by permanent lockout after 20 attempts</li><li>Launcher: fix layout for search bar which is broken in upstream AOSP due to lack of a predictive service</li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040300">2026040300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040300">2026040300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026032000 release:</p><ul><li>Keyboard: add heuristic for detecting the input field is a Jetpack Compose TextField to work around a bug in Compose's implementation breaking backspace functionality by falling back to a legacy approach</li><li>fix upstream use-after-free bug caught by MTE in the Pixel HWC3 service when an external display connects which causes soft reboots</li><li>fix StrictMode BackgroundActivityLaunchCallback leak which was leading to exhaustion of the binder proxy object limit causing a crash</li><li>Contact Scopes: resolve app compatibility issue causing crashes due to missing handling for _count queries when scopes are empty</li><li>Sandboxed Google Play compatibility layer: improve the user experience for using Google Messages RCS by showing users the access it requires is being requested along with overhauling the implementation</li><li>Sandboxed Google Play compatibility layer: permit Android Auto retrieving A2DP connection policy when the special access permission for wireless Android Auto is granted to improve compatibility beyond the stub in GmsCompatConfig version 169</li><li>Pixel 10a: add missing Multiuser app for multi-user switcher widget</li><li>Pixel 10a: backport Android 16 QPR3 GNSS HAL to resolve a mismatch resulting in inaccurate GNSS data</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.129</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.77</li><li>adevtool: update the cellular modem carrier configuration database for Cape to fix VoWifi support prior to the change shipping in the stock Pixel OS</li><li>adevtool: heavily optimize carrier config decoding</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-168">version 168</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-169">version 169</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.164.0">version 146.0.7680.164.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.24.0">version 147.0.7727.24.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.0">version 147.0.7727.49.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.1">version 147.0.7727.49.1</a></li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026032000">2026032000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026032000">2026032000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026030700 release:</p><ul><li>add experimental Pixel 10a support</li><li>Launcher: change app drawer search bar to cancelling search when the back action is invoked instead of the query becoming empty</li><li>backport SELinux policy for CameraX extensions property used by the Pixel Camera HAL from Android 16 QPR3</li><li>hardened_malloc: multiple small optimizations to improve performance</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.166</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.127</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.76</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.65.1">version 146.0.7680.65.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.111.0">version 146.0.7680.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.115.0">version 146.0.7680.115.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.119.0">version 146.0.7680.119.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.153.0">version 146.0.7680.153.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/91">version 91</a></li><li>switch to cross-device gmscompat_lib key for 10th gen Pixels</li><li>adevtool: add support for keeping only certain unpacked images to help with constrained storage</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026032001 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030700">2026030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030700">2026030700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030500 release:</p><ul><li>update Pixel Camera HAL to CP1A.260305.018 (Android 16 QPR3) to resolve compatibility issues with the backported Android 16 QPR3 kernel drivers</li><li>Pixel 10 Pro Fold: change thermal info configuration to work around an incompatibility with the Android 16 QPR3 kernel device tree</li><li>Setup Wizard: add opt-in toggles for geocoding to the Location services page since we now have a GrapheneOS geocoding service able to handle a large number of users</li><li>replace "OpenStreetMaps" with the correct "OpenStreetMap" for the geocoder server option name</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.65.0">version 146.0.7680.65.0</a></li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030500">2026030500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030500">2026030500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030200 release:</p><ul><li>full 2026-03-05 security patch level</li><li>integrate extra security patches not included in the Android Security Bulletin from the March 2026 Android 16 security tag release</li><li>update Pixel kernel sources to CP1A.260305.018 (Android 16 QPR3)</li><li>update Pixel firmware and a large portion of the driver libraries/HALs to CP1A.260305.018 (Android 16 QPR3)</li><li>fix Network permission enforcement for MediaPlayerService clients by closing a bypass caused by an upstream Android vulnerability for INTERNET permission enforcement caused by using case-sensitive rather than case-insensitive string comparisons</li><li>rename geocoder options to "GrapheneOS server" and "OpenStreetMaps server" since we're now self-hosting Nominatim instead of providing a proxy to the OpenStreetMaps instance</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030200">2026030200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030200">2026030200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030100 release:</p><ul><li>full 2026-03-01 security patch level</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48649, CVE-2025-48652, CVE-2026-0016, CVE-2026-0018, CVE-2026-0022, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030100">2026030100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030100">2026030100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026021200 release:</p><ul><li>SystemUI: migrate to the modern lockscreen infrastructure (smartspace) for showing lockscreen device status info to avoid many upstream bugs caused by AOSP still using the legacy lockscreen infrastructure no longer used on the stock Pixel OS (this allows us to revert a bunch of downstream fixes we were using)</li><li>Settings: don't allow disabling eSIM when eSIM management support is disabled since it can persistently prevent using the eSIMs without using ADB shell to undo it</li><li>modify our multicast firewall to stop dropping route advertisements received on the VPN interface which sometimes breaks IPv6 connectivity</li><li>fix rare edge preventing dismissing the UI for our 2-factor fingerprint unlock feature</li><li>Setup Wizard: add opt-in toggles for network-based location and always available Wi-Fi scanning to the Location services page</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): raise lockdown mode from integrity to confidentiality mode to match the other devices</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): add workaround for an upstream arm64 KVM bug breaking booting with lockdown in confidentiality mode</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.163</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.126</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.73</li><li>hardened_malloc: update libdivide to 5.3.0</li><li>hardened_malloc: fix handling one form of realloc from small allocations made with alignment above PAGE_SIZE (no known real world examples and it would be crashing if it was happening since it causes internal invalid accesses unable to go outside the bounds of the protected metadata region which is mainly PROT_NONE)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.75.0">version 145.0.7632.75.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.109.0">version 145.0.7632.109.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.120.0">version 145.0.7632.120.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.31.0">version 146.0.7680.31.0</a></li><li>adevtool: handle Node.js fs.cp behavior change</li><li>adevtool: update dependencies</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2025-64783, CVE-2025-64784, CVE-2025-64893, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026021200">2026021200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026021200">2026021200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026020600 release:</p><ul><li>Sandboxed Google Play compatibility layer: add toggle for granting Play services access to ICC auth in order to support RCS with carriers requiring it for RCS in Google Messages including T-Mobile (see <a href="https://grapheneos.org/usage#rcs">RCS usage guide</a>)</li><li>Launcher: fix rare upstream crash when switching users</li><li>Dialer: add new opt-in implementation of call recording using the same framework APIs as Google Dialer with the goal of improving functionality (handover support) and robustness (currently an opt-in setting for testing and then it will replace the previous implementation)</li><li>kernel (6.1, 6.6, 6.12): re-enable standard forced module signing with a workaround to make pKVM compatible with it</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.162</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.123</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.69</li><li>change default quick tile configuration for the new UI (replacing cast, wallet and device controls with camera, microphone and NFC toggles by default)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.45.1">version 145.0.7632.45.1</a></li><li>update release signing to handle AOSP APEX changes</li><li>migrate otatools.zip changes to Android's modern build system (soong)</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026021201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026020600">2026020600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026020600">2026020600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026020400 release:</p><ul><li>raise declared Android security patch level to 2026-02-05 which has been provided since we moved to Android 16 QPR2 in December (was meant to be declared in the previous release)</li><li>add cross-SIM calling support (making calls using a SIM via the mobile data provided by another SIM similarly to Wi-Fi calling); requires Automatic data switching in SIM settings, and existing installs may need to toggle Automatic data switching off and on to enable cross-SIM calling</li><li>extend our carrier override feature with a toggle for forcing the availability of cross-SIM calling support</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.45.0">version 145.0.7632.45.0</a></li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026020601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026020400">2026020400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026020400">2026020400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026012800 release:</p><ul><li>raise declared Android security patch level to February 2026 which has been provided since we moved to Android 16 QPR2 in December (currently declared as 2026-02-01 even though 2026-02-05 has been provided since Android 16 QPR2 but it wasn't worth restarting the builds)</li><li>update to February 2026 Pixel driver/firmware code providing the 2026-02-05 Pixel security patch level</li><li>Dialer: fix call recording button state after fragment re-creation to avoid showing call recording as active when it isn't</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.121</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.26.0">version 145.0.7632.26.0</a></li><li>switch to 64-bit-only Vanadium releases for devices without 32-bit support (7th gen Pixels and later)</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/34">version 34</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/35">version 35</a></li><li>switch from 6.6 kernel branch to 6.12 kernel branch for emulator builds (used for development) to match AOSP since Android 16 QPR2</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026020401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026012800">2026012800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026012800">2026012800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026012100 release:</p><ul><li>FusedLocationProvider: restore pre-16-QPR1 GNSS usage policy of using GNSS for both balanced and high power requests instead of only high power requests since many GrapheneOS users don't enable network location and network location may not always be accessible such as temporarily not having internet access</li><li>Sandboxed Google Play compatibility layer: add special case for sandboxed Play services making it so users granting the SMS permission enables reading SMS addressed to apps using the Google Play services client library (Android 16 QPR2 prevented using the SMS permission to read SMS addressed to other apps so a special case is needed for apps which use Google Play services to handle SMS-based authentication)</li><li>Sandboxed Google Play compatibility layer: prevent sandboxed Play Store attempting to install the "Device configuration" package which is not used on GrapheneOS and serves no purpose</li><li>avoid compatibility issues with misguided anti-tampering checks in a tiny subset of apps by changing the initial call stack for secure app spawning (exec spawning) to match the standard zygote-based spawning so these apps no longer detect secure spawning as an altered call stack indicating tampering</li><li>Settings: require device restart after changing the secure app spawning setting</li><li>Sandboxed Google Play compatibility layer: update Android Auto configuration UI to Material 3 Expressive</li><li>add workaround for upstream system_server startUserInBackgroundTemporarily crash</li><li>fix GrapheneOS support for recording permission usage history for a broader set of permissions</li><li>Dialer: set CallStyle for call notifications to improve the user interface and replace our temporary workaround of disabling notification grouping for it</li><li>Network Location: rename "GrapheneOS proxy" option to "GrapheneOS Apple proxy" for clarity</li><li>Network Location: add "Apple China" server choice required for China data due to China's laws about mapping the country (currently no proxy due to poor connectivity to and from China causing reliability issues with connecting to Apple's servers in China from ours but we plan to offer it as an option in the future)</li><li>Pixel 8a, 9th gen Pixels and 10th gen Pixels: disable NTP usage in Samsung gnssd which isn't as useful on GrapheneOS due to reducing the system time update threshold from 2000ms to 50ms along with avoiding us needing to redirect this to our own NTP service as we did for Qualcomm xtra-daemon</li><li>update code for disabling reporting of harmless fingerprint-service.goodix crash</li><li>improve user interface for Network/Sensors permissions in the permission manager</li><li>fix minor Material 3 Expressive styling issues for the Contact Scopes and Storage Scopes configuration UI</li><li>adevtool: raise minimal supported Node.js version to 24</li><li>adevtool: disallow running adevtool as root</li><li>adevtool: check for presence of prebuilts dirs at startup</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.67</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.109.0">version 144.0.7559.109.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026012100">2026012100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026012100">2026012100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026011300 release:</p><ul><li>fix an upstream infinite loop bug in ProtoFieldFilter.skipBytes() causing an upstream system_server issue leading to the OS being unusable in early boot for a tiny subset of users since Android 16 QPR2 (there are a bunch of reports of these symptoms with the stock Pixel OS)</li><li>libpng: backport security patches</li><li>remove unused INTERNET permission from Pixel Camera Services since GrapheneOS doesn't support the Pixel Connected Cameras feature</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.161</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.66</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): enable lockdown in integrity mode which is a major step towards matching the other devices using it in confidentiality mode</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.59.0">version 144.0.7559.59.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.59.1">version 144.0.7559.59.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.76.0">version 144.0.7559.76.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.76.1">version 144.0.7559.76.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.90.0">version 144.0.7559.90.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0036</li><li>Unclassified: CVE-2026-0035</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026011300">2026011300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026011300">2026011300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026011000 release:</p><ul><li>update to January 2026 Pixel driver/firmware code for the subset of devices with a January 2026 release</li><li>allow user to set any account as the default contacts account (since Android 16 QPR1, this was restricted to Google accounts for the stock Pixel OS and nothing permitted at all for AOSP)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.159</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026011301 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026011000">2026011000</a></h3><p>Support for 10th gen Pixels is no longer considered experimental.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026011000">2026011000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026010800 release:</p><ul><li>reimplement the standard Android USB data signal API with our hardware + software USB blocking functionality to preserve support for the device admin and lockdown mode features for fully toggling off USB while upgrading it to use hardware blocking (this was omitted in the previous Alpha-only release)</li><li>fix regression in the last release causing sandboxed Google Play breakage in a subset of secondary users caused by the phenotype flag changes in the previous release</li><li>Sandboxed Google Play compatibility layer: add stub for ContentResolver.acquireUnstableProvider()</li><li>fix the Terminal virtual machine management app not working in a secondary user Private Space (GrapheneOS adds the ability to use the Terminal app in secondary users and also adds the ability to use Private Space in secondary users, so the combination of those things resulted in this being possible but the upstream code was incompatible with it)</li><li>Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold: add high EMF (PWM) mode opt-in to the Settings app</li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026011001 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026010800">2026010800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026010800">2026010800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025122500 release:</p><ul><li>raise declared Android security patch level to 2026-01-05 which has been provided since we moved to Android 16 QPR2 in December due to Pixels shipping CVE-2025-54957 in December</li><li>re-enable the system keyboard package at boot if the package is disabled (does not change keyboard settings)</li><li>switch to the system keyboard when device boots to the Safe Mode</li><li>add "Reboot to Safe Mode" power menu button in Before First Unlock state to make Safe Mode much more discoverable for working around app issues such as a broken third party keyboard</li><li>add workaround for upstream UsageStatsDatabase OOM system_server crash</li><li>add workaround for upstream WindowContext.finalize() system_server crash</li><li>disable buggy upstream disable_frozen_process_wakelocks feature causing system_server crashes for some users</li><li>Sandboxed Google Play compatibility layer: fix phenotype flags not working in Play services clients</li><li>Sandboxed Google Play compatibility layer: add MEDIA_CONTENT_CONTROL as a requested permission for Android Auto as part of our toggles for it to avoid needing to grant the far more invasive notification access permission</li><li>Sandboxed Google Play compatibility layer: extend opt-in Android Auto Bluetooth support to allow A2dpService.setConnectionPolicy() to fix Bluetooth functionality (previously worked around with a GmsCompatConfig update avoiding a crash)</li><li>switch to new upstream PackageInstallerUI implementation added in Android 16 QPR2 and port our changes to it</li><li>update SQLite to 3.50.6 LTS release</li><li>add an extra layer of USB port protection on 10th gen Pixels based on upstream functionality to replace our USB gadget control which was causing compatibility issues with the Pixel 10 USB drivers</li><li>allow SystemUI to access NFC service on 10th gen Pixels to fix the NFC quick tile</li><li>disable the upstream Android USB data protection feature since it conflicts with our more advanced approach and causes issues</li><li>issue CHARGING_ONLY_IMMEDIATE port control command in more cases</li><li>fix an issue in our infrastructure for spoofing permission self-checks breaking automatically reading SMS one-time codes for certain apps</li><li>add workaround for upstream KeySetManagerService system_server crash causing a user to be stuck on an old OS version due to it causing a boot failure when booting a the new OS version after updating</li><li>wipe DPM partition on 10th gen Pixels as part of installation as we do on earlier Pixels since it's always meant to be zeroed on production devices</li><li>Settings: disable indexing of the unsupported "Parental controls" setting which is not currently available in AOSP</li><li>Settings: disable redundant indexing of widgets on lockscreen contents which is already indexed another way</li><li>skip all pseudo kernel crash reports caused by device reboot to avoid various false positive crash reports</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.192.0">version 143.0.7499.192.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026010801 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025122500">2025122500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025122500">2025122500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121700 release:</p><ul><li>restore support for bypassing carriers disallowing choosing the cellular network mode (this was lost in a recent major version migration such as the port to Android 16 QPR1 but we aren't sure exactly when it regressed)</li><li>remove poorly designed upstream end session button on the lockscreen (it remains available in the power menu)</li><li>enable feature flag for new upstream end session button in the user switcher</li><li>switch to vendor files from 2nd December 2025 release (BP4A.251205.006.E1) for devices with it available</li><li>enable lockscreen widget support</li><li>fix upstream system_server crash in NotificationHistoryProtoHelper</li><li>Wi-Fi HAL: ignore debug logging requests on all Pixels with MTE support to avoid a crash from detecting an invalid memory access in the upstream code</li><li>Sandboxed Google Play compatibility layer: add support for redirecting Google Play location service requests from within Google Play services itself which means the GrapheneOS provided network location will work for internal Play services features such as Google Maps location sharing when redirecting to the OS is enabled (which is the default) and the Location permission is granted to it</li><li>Sandboxed Google Play compatibility layer: force redirecting Google Play location service requests from within Google Play services and Android Auto when the Location permission is disabled for better error handling (neither properly handles the Location permission not being granted since it's always granted on any Google Mobile Services OS in practice instead of being explicitly opt-in)</li><li>Sandboxed Google Play compatibility layer: fix a compatibility issue with the Chromium test suite</li><li>Network Location: improve position estability accuracy and stability</li><li>Network Location: prevent potential division by zero exception</li><li>Network Location: improve experimental Wi-Fi RTT support which is still disabled in production</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.119</li><li>kernel (6.6): disable CONFIG_TLS to reduce attack surface</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.63</li><li>kernel (6.12): disable CONFIG_TLS to reduce attack surface</li><li>include configuration for thermometer on 10th gen Pixels</li><li>adevtool: auto-detect filesystem image type (ext4 vs. EROFS)</li><li>adevtool: add support for canary builds</li><li>adevtool: improve performance</li><li>remove obsolete workaround for using a prebuilt recovery extension</li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025122501 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121700">2025121700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121700">2025121700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121200 release:</p><ul><li>add workaround for upstream system_server WallpaperManagerService.hasPermission() crash</li><li>fix upstream system_server crash in NotificationHistory.getPooledStringsToWrite()</li><li>Launcher: add a workaround for upstream QuickstepModelDelegate.getContainer() crash</li><li>set initial port security state at an earlier boot stage to improve debugging on production builds where the port state has been changed from the default "Charging-only when locked" to "Charging-only when locked, except before first unlock" or "On"</li><li>use default desktop mode configuration since our changes are no longer needed to enable features and caused crashes for at least 1 user which were addressed with an out-of-band release prior to this one</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): add back recent dma-buf changes now that an upstream use-after-free bug is resolved</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.118</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.146.0">version 143.0.7499.146.0</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121701 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121200">2025121200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121200">2025121200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121000 release:</p><ul><li>disable notification summaries and organizer features due to AOSP and GrapheneOS lacking the AI models used to implement these features</li><li>add workaround for notification background appearance regression in Android 16 QPR2</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.109.0">version 143.0.7499.109.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-167">version 167</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121201 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121000">2025121000</a></h3><p>This is our first non-experimental release based on Android 16 QPR2 after our initial experimental 2025120800 release.</p><p>The change to the style of notification backgrounds is an upstream regression rather than an intentional change to a more minimal style. It will be fixed in a subsequent release since we decided it isn't important enough to delay this.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121000">2025121000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025120400 release:</p><ul><li>full 2025-12-05 security patch level</li><li>rebased onto BP4A.251205.006 Android Open Source Project release (Android 16 QPR2)</li><li>disable promotion of identity check feature not currently present in GrapheneOS due to depending on privileged Google Mobile Services integration</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-166">version 166</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121001 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025120400">2025120400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025120400">2025120400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025112100 release:</p><ul><li>full 2025-12-01 security patch level (has already been fully provided by our security preview releases for at least a month and most of the patches since September)</li><li>add experimental support for the Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold (there were 2 standalone experimental releases prior to this via 2025112500 and 2025113000 along with corresponding security preview releases for each)</li><li>Cell Broadcast Receiver: switch back to our modified text for the presidential alerts toggle</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.158</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.116</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.60</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/90">version 90</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.0">version 143.0.7499.34.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.1">version 143.0.7499.34.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.2">version 143.0.7499.34.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.52.0">version 143.0.7499.52.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-164">version 164</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-165">version 165</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025120401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0006</li><li>High: CVE-2025-26447, CVE-2025-32348, CVE-2025-48578, CVE-2025-48579, CVE-2025-48582, CVE-2025-48585, CVE-2025-48587, CVE-2025-48609, CVE-2025-48622, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008, CVE-2026-0009, CVE-2026-0010</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025112100">2025112100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025112100">2025112100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025111800 release:</p><ul><li>fix regression from our Android 16 QPR1 port causing enabling the Network permission to not work without a reboot</li><li>adevtool: fix SELinux policy handling issue causing fingerprint registration issues on the devices with power button fingerprint readers (Pixel Tablet, Pixel Fold, Pixel 9 Pro Fold) with Android QPR1</li><li>fix port of our notification forwarding between user profiles feature to Android 16 QPR1</li><li>enable new UI customization picker UI from Android 16 QPR1</li><li>Wallpaper Picker: don't use the CuratedPhotos categories which aren't setup in AOSP</li><li>Wallpaper Picker: hide the always-empty wallpaper carousel</li><li>Wallpaper Picker: enable integration of the embedded photo picker</li><li>System Updater, Sandboxed Google Play compatibility layer: switch to Material 3 Expressive theme for Settings app menus</li><li>Cell Broadcast Receiver: fix presidential alerts toggle added by GrapheneOS not being enabled without the main emergency alerts toggle being toggled off and on</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.171.0">version 142.0.7444.171.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025112101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025111800">2025111800</a></h3><p>Following our experimental releases, this is our first non-experimental release based on Android 16 QPR1, the first quarterly release of Android 16. Android 16 QPR1 was pushed to the Android Open Source Project on November 11 rather than September 3 as expected. This is a very large quarterly release with more prominent user-facing improvements than Android 16 provided compared to Android 15 QPR2.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025111800">2025111800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025110800 release:</p><ul><li>rebased onto BP3A.250905.014 Android Open Source Project release (Android 16 QPR1)</li><li>Terminal (virtual machine management app): re-enable GUI support now that the surfaceflinger crashes are resolved upstream by Android 16 QPR1</li><li>adevtool: massive overhaul entirely replacing the small remnants of the Pixel device trees to fix several regressions introduced since Android 16 such as charging mode booting into the regular OS and to prepare for adding 10th gen Pixel devices via automated device support without any need for device trees to use as a reference</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>raise declared patch level to 2025-11-05 which has already been provided in GrapheneOS since our regular <a href="https://grapheneos.org/releases#2025090200">2025090200</a> release (not a security preview) since the patches were included in the September security preview and were then pushed to AOSP despite not being listed in the bulletin along with there being no Pixel Update Bulletin patches for November 2025</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.158.0">version 142.0.7444.158.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025111801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>The official Android security preview patches are for the initial release of Android 16 and we had to port the patches to Android 16 QPR1. This resulted in it taking significantly longer to be available. Due to this, 2025111801 also bundles Vanadium 142.0.7444.171.0 which was released through our App Store after the regular OS release but prior to the security preview OS release. It's otherwise a normal security preview release with no non-security-preview patch related changes beyond the Vanadium release being included.</p><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025110800">2025110800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025110800">2025110800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025110600 release:</p><ul><li>adevtool: fully automate handling SoC and radio firmware image backports, which resolves an issue with a version string mismatch in the previous release for the initial installation process which resulted in us cancelling the Stable channel release</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.138.1">version 142.0.7444.138.1</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025110600">2025110600</a></h3><p>Both of the November 2025 patches have been provided in our regular non-security-preview releases for over a month, so we've already had the 2025-11-05 Android security patch level for over a month. Our patch level is set based on providing both the Android and Pixel security patches, so we're leaving it at 2025-11-01 until the Pixel stock OS release and Pixel Update Bulletin are published. The stock Pixel OS also included both November 2025 patches in early September. We expect they made a 2nd October release to ship the November carrier changes and will make a release in mid-November with patches from future Android Security Bulletins.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025110600">2025110600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102800 release:</p><ul><li>raise declared patch level to 2025-11-01 which has already been provided in GrapheneOS since our regular <a href="https://grapheneos.org/releases#2025090200">2025090200</a> release (not a security preview) since the patches were included in the September security preview and were then pushed to AOSP despite not being listed in the bulletin</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): keep POSIX_MQUEUE disabled to avoid increasing attack surface</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.114</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>adevtool: switch to obtaining Android 16 QPR1 backports from the latest November releases for relevant Pixels (there are no security patches listed for the Android or Pixel bulletins and not all Pixels received the tiny release)</li><li>Settings: add 1 second delay for approving device admin activation to mitigate tapjacking (this matches the 1 second delay we add to both permission prompts and ADB authorization prompts which is currently not configurable)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.138.0">version 142.0.7444.138.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102800">2025102800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102800">2025102800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102600 release:</p><ul><li>Sandboxed Google Play compatibility layer: temporarily limit system service override infrastructure added for GmsFontProvider shim to Pixel Camera to work around certain banking apps detecting it as tampering (we can change the approach to avoid this to enable it for all apps using the Google Play client libraries again, especially since we want to expand it to improve app compatibility without Play services installed)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.112</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.53</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102600">2025102600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102600">2025102600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102300 release:</p><ul><li>Sandboxed Google Play compatibility layer: add shim implementation of GmsFontProvider to prevent crashes of apps depending on Play services when it's missing or disabled (restores support for using Pixel Camera without Play services)</li><li>Sandboxed Google Play compatibility layer: extend shim for background service starts to address edge cases where a foreground service is required</li><li>Sandboxed Google Play compatibility layer: fix NoOpPrewarmService chain crash in Pixel Camera caused by lack of privileged OS integration</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.48.0">version 142.0.7444.48.0</a></li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102300">2025102300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102300">2025102300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102200 release:</p><ul><li>fix signing the GmsCompatLib package with a dedicated cross-device key, which was added in the last release but wasn't being replaced by a release key and blocked moving the last release past Alpha</li><li>kernel (6.12): update to latest GKI LTS branch revision</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102200">2025102200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102200">2025102200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025100900 release:</p><ul><li>adevtool: add satellite eSIM overlays to avoid the special Skylo eSIM on 9th/10th gen Pixels being listed as a regular eSIM and being possible to erase with the regular eSIM erase functionality</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.111</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.52</li><li>System Updater: prevent reboot and security preview notifications from timing out after 3 days which is standard behavior since Android 15 QPR1</li><li>System Updater: mark notification permission as fixed to prevent disabling overall notifications but exclude the channels for progress, errors and already up to date notifications from it so that only reboot and security preview notifications are mandatory</li><li>Sandboxed Google Play compatibility layer: add support for overriding BinderProxy transactions</li><li>Sandboxed Google Play compatibility layer: add support for out-of-band updates to GmsCompatLib</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.111.0">version 141.0.7390.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.122.0">version 141.0.7390.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-163">version 163</a></li><li>raise emulator super / dynamic partition size due to reaching the limit in some cases</li><li>adevtool: prefer prebuilt AOSP JDK 21</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025100900">2025100900</a></h3><p>One of the changes in this release should result in Google Messages RCS working for users receiving a verification error caused by Play Store checking for an emulator with an easy to bypass check. It was already working for many users without this but this should get it working for everyone else.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025100900">2025100900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025100300 release:</p><ul><li>raise security patch level to 2025-10-05 since it's already provided without applying any additional patches</li><li>System Updater, Setup Wizard: integrate support for recommending opting into security preview releases during the initial Owner user setup and for existing users via a persistent notification which is disabled after making an explicit choice on whether to use security preview releases (this is necessary to inform all users about the option with an explicit choice)</li><li>Settings: add support for forcing VoWiFi availability</li><li>Settings: improve the carrier configuration override by improving the summaries, adding detailed descriptions and using clarifying the options force features to be available since there are also toggles for directly enabling/disabling the features in the main SIM settings screen</li><li>Sandboxed Google Play compatibility layer: fix a Google Messages RCS compatibility issue by removing the error string for the missing privileged permission from SurfaceFlinger::doDump() to make a DroidGuard check pass</li><li>Sandboxed Google Play compatibility layer: make Play Store ignore app auto-install config</li><li>Sandboxed Google Play compatibility layer: fix Build.getSerial() shim to fix an Android Auto issue</li><li>Sandboxed Google Play compatibility layer: add stub for TelephonyManager.getImei()</li><li>Sandboxed Google Play compatibility layer: add stub for Window.setHideOverlayWindows() to replace reliance on a feature flag override via GmsCompatConfig</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.155</li><li>update test suite to handle our carrier overrides support</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.70.0">version 141.0.7390.70.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/90">version 90</a></li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025100901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025100300">2025100300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025100300">2025100300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025092700 release:</p><ul><li>add support for force enabling VoLTE, VoNR and 5G for carriers where those aren't supported with the standard configurations</li><li>revert backport of Pixel Wi-Fi extension APEX from Android 16 QPR1 due to it causing a system_server crash since it needs changes there too (this does not reduce the patch level)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.154</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.108</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.49</li><li>update SQLite to 3.44.5 LTS release</li><li>Network Location, System Updater: add new Let's Encrypt roots to TLS key pinning configuration</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-162">version 162</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/89">version 89</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025100301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>CVE-2025-48595 was fixed in the regular GrapheneOS 2025100300 release and is no longer listed.</p><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025092700">2025092700</a></h3><p>This release adds official support for using RCS in Google Messages. Using this requires granting the Phone permission to Play services to provide carrier information to it, granting the required permissions to Google Messages and then setting Google Messages as the current carrier messaging app. Setting an app as the carrier messaging app provides it with device identifier access which is documented in our FAQ. However, Google Messages is a special case where part of the implementation is in Play services. We've dealt with this by special casing the device identifier permission check to detect when the user has granted this access to the official Google Messages app which then also provides the official Play services app with the same access. This doesn't provide any extra access in practice since Google Messages shares the information with Play services.</p><p>Re-enabling RCS after disabling it isn't expected to work yet and you'll need to clear the app data to enable it.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025092700">2025092700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025092500 release:</p><ul><li>add SystemUI and Settings integration for detecting and notifying Pixel 6a users with batteries impacted by the fire hazard issue resulting in capacity and charging being throttled along with directing users to the support options for getting a free battery replacement, $150 credit or $100 cash as compensation for the faulty battery (a subset of this will be replaced by AOSP code when Android 16 QPR1 is finally pushed to AOSP)</li><li>Sandboxed Google Play compatibility layer: add request for the unprivileged <code>READ_PHONE_NUMBERS</code> permission to Play services which users can manually grant via the Phone permission since it's needed for RCS activation but is not requested since they request the privileged permission instead</li><li>Sandboxed Google Play compatibility layer: when users have granted device identifier access to the official Google Messages app by setting it as the default SMS/MMS/RCS app</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.43.0">version 141.0.7390.43.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.43.1">version 141.0.7390.43.1</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025092701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48595, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025092500">2025092500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025092500">2025092500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025091900 release:</p><ul><li>System Updater: add support for opting into security preview releases</li><li>backport more cellular related code from Android 16 QPR1</li><li>backport Pixel Wi-Fi extension APEX from Android 16 QPR1</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.207.0">version 140.0.7339.207.0</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025092501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48595, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025091900">2025091900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025091900">2025091900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025091000 release:</p><ul><li>backport latest carrier and cellular radio configurations from Android 16 QPR1</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.152</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.104</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.47</li><li>kernel (6.6): prepare for usage on bare metal arm64 devices by setting up arm64 emulator builds (Pixel 10 uses 6.6 and earlier Pixels will likely move to it soon)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.155.0">version 140.0.7339.155.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025091000">2025091000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025091000">2025091000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090800 release:</p><ul><li>full 2025-10-01 security patch level</li><li>partially backport Android 16 QPR1 Pixel userspace device support: RIL, eSIM, TPU and NeuralNetworks (deprecated)</li><li>kernel (6.1): roll back recent upstream Android GKI dma-buf changes due to a few MTE crash reports</li><li>kernel (6.1, 6.6, 6.12): disable unused memory hotplug support</li><li>kernel (6.1, 6.6, 6.12): fix linear region randomization by dropping memory hotplug support (see <a href="https://project-zero.issues.chromium.org/issues/434208461">the Project Zero issue</a> where the upstream Linux maintainers decided not to fix the issue)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.45</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.123.0">version 140.0.7339.123.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090800">2025090800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090800">2025090800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090600 release:</p><ul><li>backport the rest of the Android 16 QPR1 Pixel firmware (Bluetooth, Wi-Fi, GNSS, UWB, NFC, secure element, GPU, AOC, TPU and GXP)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090600">2025090600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090600">2025090600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090500 release:</p><ul><li>Pixel Tablet: fix regression for install zips in the previous release causing a version check for non-existent cellular baseband firmware to fail when doing the initial installation</li><li>add back Git commit metadata for the kernel image and modules by setting an environment variable to use the repo metadata from the Pixel kernel tarballs</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090500">2025090500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090500">2025090500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090300 release:</p><ul><li>move to new monolithic Pixel kernel repository setup with a single repository for Pixels and our portable Generic Kernel Image repository as a submodule to more easily handle Pixel kernel sources being released as tarballs instead of Git tags (Git metadata for the kernel image and modules will be added back in the next release)</li><li>update to Android 16 QPR1 kernel drivers and kernel build system to ship the security patches prior to Android 16 QPR1 being released to AOSP</li><li>update Pixel SoC and cellular radio firmware to the Android 16 QPR1 releases to ship the security patches prior to Android 16 QPR1 being released to AOSP</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/32">version 32</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/33">version 33</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.51.0">version 140.0.7339.51.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090300">2025090300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090300">2025090300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090200 release:</p><ul><li>Sandboxed Google Play compatibility layer: add stub for Debug.dumpService("media_projection") to fix a recent regression caused by a Google Play Store behavior change yesterday which was breaking using the Play Integrity API and therefore slightly reducing app compatibility</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090200">2025090200</a></h3><p>This is an early September security update release based on the September 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090200">2025090200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025081400 release:</p><ul><li>full 2025-09-01 security patch level</li><li>add support for address lines in the GrapheneOS geocoder implementation</li><li>Dialer: fix visual voicemail with Verizon MVNOs by working around AOSP Dialer not supporting vvm_type_vvm3_mvno</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.148</li><li>kernel (6.1): reapply minor f2fs change we previously reverted due to it causing a regression since the stock Pixel OS has shipped it a while ago so the regression must have been fixed by other changes</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.102</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.42</li><li>adevtool: massive overhaul to improve our infrastructure for device support</li><li>adevtool: add command for extracting aconfig flag values from device images</li><li>adevtool: add command for decompiling APKs and JARs from device images and creating an IntelliJ project from it</li><li>adevtool: detect missing vendor regeneration after adevtool changes</li><li>adevtool: parallelize state regeneration and remove unnecessary data from serialized build state files</li><li>Theme Picker: use AOSP launcher name for fetching resources in preparation for Android 16 QPR1 requiring this to be set up properly</li><li>Settings: prepare PIN scrambling setting for the upcoming port to Android 16 QPR1</li><li>Seedvault: update to 16-5.7 (there are no changes to the code compared to the Android 16 development revision we previously shipped, only translation changes)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-161">version 161</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.158.0">version 139.0.7258.158.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.35.0">version 140.0.7339.35.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/87">version 87</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/88">version 88</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/31">version 31</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/31">version 31</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025081400">2025081400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025081400">2025081400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025081300 release:</p><ul><li>temporarily revert extended fix for upstream MediaMetadata bug due to it causing a regression and needing to be adjusted</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/86">version 86</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025081300">2025081300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025081300">2025081300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025080600 release:</p><ul><li>limit MediaMetadata object size to avoid Binder failures to resolve the rest of an upstream Android denial of service issue triggered in real world use by LibreTube (this extends our previous fix in our <a href="https://grapheneos.org/releases#2025072700">2025072700</a> release)</li><li>reduce time update threshold to 50ms from Android's default 2000ms instead of allowing the clock to get up to 2s out-of-date (this change was lost during one of the major release ports when Android significantly changed the code and moved where this is configured)</li><li>Pixel 8a: fix inclusion of PSDS overlay since our port to Android 16 which was breaking using our PSDS proxy until we worked around it server-side with a redirect from broadcom.psds.grapheneos.org to samsung.psds.grapheneos.org for the Samsung PSDS download path</li><li>Samsung GNSS devices (Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a): switch to TLSv1.3-only for SUPL instead of TLSv1.2-only now that it's supported by gnssd</li><li>change User-Agent for geocoder to "GrapheneOS geocoder $USER_AGENT_VERSION" where the version is currently 1 and can be incremented if there are significant changes to how we make requests (this was previously using the default Android User-Agent sending more information than necessary)</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.101</li><li>Seedvault: update to latest revision for Android 16 (will be replaced with a better backup implementation in the future)</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/84">version 84</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/85">version 85</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/6">version 6</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.123.0">version 139.0.7258.123.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025080600">2025080600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025080600">2025080600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025080400 release:</p><ul><li>full 2025-08-05 security patch level</li><li>apply the only change not related to the Pixel 6a battery workaround from the August 2025 Pixel kernel drivers obtained via GPL source request</li><li>update to August 2025 Pixel vendor/firmware code</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/12">version 12</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025080400">2025080400</a></h3><p>This is an early August security update release based on the August 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Android Security Bulletin tags have not yet been pushed to the Android Open Source Project this month but we've had access to the signed partner bulletin zip with the same patches for a month. There are only 3 patches in the August 2025-08-01 bulletin and one of those doesn't impact Android 16. Of the 2 marked as impacting Android 16, the critical severity issue was already fixed in the initial Android 16 release. Therefore, there's only a single High severity patch to Android 16 for the Android Open Source Project for August.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025080400">2025080400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025073000 release:</p><ul><li>full 2025-08-01 security patch level</li><li>add opt-in service for geocoding (translating location names to coordinates) and reverse geocoding (translating coordinations to location names) with the option of either a GrapheneOS proxy to Nomanatim or direct use of Nominatim which will improve compatibility with a tiny subset of apps depending on the OS providing this without an alternative (the service is open source with open data so our proxy is temporary and will be replaced with a self-hosted service, but we need to determine if we want to use Nominatim or Photon along with dealing with the high hardware requirements far beyond what our current network servers can provide)</li><li>add a workaround for bug in sonycast.sdk.ScMediaRouteProvider used by Tidal and other apps causing occasional NsdService related crashes in combination with VPN lockdown due to us fixing NsdService related VPN leaks</li><li>override pseudo locales with their respective base locales in the Android Runtime since they're currently broken and break using the device (we already disabled enabling pseudo locales in the previous release but a couple users enabled this developer option and need a release fixing it to use their device)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.147</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.100</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.62.0">version 139.0.7258.62.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.62.1">version 139.0.7258.62.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025073000">2025073000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025073000">2025073000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025072800 release:</p><ul><li>extend our workaround for the upstream Android asynchronous dexopt optimization issue to handle original-package package renaming which we used to rename Vanadium's package name from org.chromium.chrome to app.vanadium.browser years ago and users on 6th gen Pixels with installs prior to it could have a crash caused by our fix for the upstream issue</li><li>add a temporary workaround for AOSP Dialer still using a legacy approach to notifications which interacts badly with notification grouping</li><li>remove support for switching to a pseudo-locale when developer options are enabled since it can cause major issues</li><li>Sandboxed Google Play compatibility layer: add stub for BluetoothDevice.getBondState() to avoid Android Auto crash</li><li>Settings: fix upstream Android null pointer exception in UserAspectRatioDetails.launchApplication()</li><li>System Updater: update minimum and target API level to 36 (Android 16)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025072800">2025072800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025072800">2025072800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025072700 release:</p><ul><li>add missing multi-user handling to the package information query used by both of the new VPN leak protections which was discovered during Alpha channel testing from app crashes in secondary users for apps not installed in the Owner user</li><li>fix implementation of INsdServiceConnector stub used as part of our NsdService#connect VPN leak protection to avoid an edge case resulting in app crashes found during Alpha channel testing</li><li>include additional overlays from the stock Pixel OS for Settings animations and Settings/SystemUI strings mostly related to documentation</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025072700">2025072700</a></h3><p>This release resolves 2 upstream Android VPN leaks discovered by GrapheneOS and our community testers. We aren't aware of any other outbound Android VPN leaks when Private DNS is set to Off. Android's Private DNS feature needs a significant overhaul for how it works with secondary profiles and VPNs.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025072700">2025072700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025071900 release:</p><ul><li>prevent using SO_BINDTODEVICE to bypass VPN lockdown mode (leak protection) to resolve an upstream Android VPN leak discovered by GrapheneOS testers where code specifies a specific interface via a special system call to bypass the VPN</li><li>prevent using NsdService#connect for components restricted by VPN lockdown mode to prevent a very limited upstream Android local network VPN leak discovered by GrapheneOS</li><li>add workaround for upstream Android asynchronous dexopt bug causing concurrent installs of the same package to be handled incorrectly which then causes crashes when attempting to uninstall</li><li>temporarily disable asynchronous pre-reboot OS update app optimization (dexopt) added in Android 16 to avoid the Finalizing step completing before apps are recompiled which can then result in it causing a very long initial boot of the new OS version if the user reboots before the background app optimization completes (this will not apply to updating to this release but rather only updating to future releases from this one and onwards)</li><li>MediaMetadata: fix upstream Android bug by using shared bitmaps to avoid serialized metadata going beyond the Binder transaction size limit and causing system service failures including Bluetooth service crashes (this issue existed prior to Android 16)</li><li>Sandboxed Google Play compatibility layer: revert change for dropping phenotype flag overrides before applying new ones since it can cause flag values to be set inconsistently due to a race</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.146</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.99</li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/4">version 4</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-160">version 160</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.168.0">version 138.0.7204.168.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.168.1">version 138.0.7204.168.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025071900">2025071900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025071900">2025071900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070800 release:</p><ul><li>Dialer: always show scrollbar for button grid when there are more than 6 buttons to make it clear it can be scrolled</li><li>Dialer: move RTT button to the end since it's rarely used</li><li>Network Location: improve position estimation implementation to provide better performance, accuracy and stability</li><li>Network Location: add support for detecting location based on cell towers when Wi-Fi-based location can't obtain any position estimate</li><li>add back "Prevent ringing" gesture via Power + Volume Up which was lost in the port to Android 16</li><li>Settings: fix discharge time estimates not being shown when charging optimization (charging limit) enabled</li><li>Settings: avoid explanation in per-app Play Integrity API settings being cut off</li><li>fully prevent empty end session button being shown</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.145</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.98</li><li>include more color overlays from the stock Pixel OS</li><li>add back desktop mode toggle to developer options which was missing due to Android 16 requiring enabling config_isDesktopModeDevOptionSupported in addition to the config_isDesktopModeSupported feature we were already enabling</li><li>adevtool: add infrastructure for defining synthetic overlays and migrate to using it (automates more of device support and results in the battery charging limit text being updated)</li><li>adevtool: heavily optimize state collection by only calculating what gets built instead of building it</li><li>enable optimization of pausing wallpaper rendering for Pixel Camera</li><li>Terminal (virtual machine management app): temporarily disable GUI support until Android 16 regression causing surfaceflinger crash is resolved</li><li>Seedvault: update to 15-5.6 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.157.0">version 138.0.7204.157.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-159">version 159</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070800">2025070800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070800">2025070800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070700 release:</p><ul><li>update to BP2A.250705.008 vendor files (July 2025 Pixel monthly release)</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed since releasing our port to Android 16 (users can enable this themselves via Settings &gt; Security and privacy &gt; More security and privacy &gt; Notify about system process crashes)</li><li>NFC: always show standard confirmation dialog before opening a URL instead of it only being enabled for a small subset of users</li><li>temporarily remove NFC auto-turn-off feature since it can cause NFC HAL or system_server crashes in rare edge cases and we need to entirely reimplement it inside of the NFC APEX module to avoid the problems (there were rare issues reported prior to Android 16 but 1 user reported an NFC HAL crash loop on Android 16 making it clear we need to drop this until we redo it in a better way)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070700">2025070700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070700">2025070700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070600 release:</p><ul><li>raise security patch level to 2025-07-05 since it's already provided without applying any additional patches</li><li>only permit third party apps to use custom activity animations for transitions between their own activities to prevent a recently disclosed <a href="https://taptrap.click/">Android tapjacking vulnerability branded as TapTrap</a></li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: fix regression breaking DisplayPort alternate mode in the previous release</li><li>Sandboxed Google Play compatibility layer: fix phenotype flag overrides not working on production builds which regressed quite a while ago and limited our ability to fix certain compatibility issues via quick GmsCompatConfig updates</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070600">2025070600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070600">2025070600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070500 release:</p><ul><li>backport fix for back button regression in Android 16 from Android 16 QPR1 Beta 2.1</li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: restore using asymmetric MTE mode for userspace instead of the default asynchronous mode</li><li>add back switching to using the Natural display color mode by default</li><li>migrate more device support to adevtool and remove more unused configuration</li><li>improve per-device integration for USB-C port control and pogo pins control to make maintenance easier</li><li>adevtool: remove obsolete overlay handling implementation</li><li>remove Circle to Search feature declaration</li><li>enable Runtime Resource Overlay (RRO) enforcement</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070500">2025070500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070500">2025070500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070301 release:</p><ul><li>partially revert upstream changes in Android 16 breaking parts of the lockscreen layout including the date and media info</li><li>Pixel 8 Pro, Pixel 9 Pro, Pixel 9 Pro XL: add back feature declaration for Pixel Thermometer support lost in our Android 16 device port migration which prevented fresh installs of the app</li><li>Terminal (virtual machine management app): disable VM console feature since it isn't supported by the stable release of Android 16 outside of debug builds and trying to use it breaks installing the new images (the feature can be enabled once the core OS supports it in production builds)</li><li>update Pixel HAL compatibility matrix version numbers for Android 16</li><li>add lockscreen synchronization failsafe to protect against unknown vulnerabilities</li><li>improve code quality and add unit tests for our strict CVE-2024-50089 protection</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.94</li><li>fix port of our 2-factor fingerprint authentication tests to Android 16</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070301">2025070301</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070301">2025070301</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070300 release:</p><ul><li>fix upstream Android 16 issue causing very large Binder transactions due to the size scaling based on the number of apps installed across all users including base OS apps</li><li>reduce virtual memory reserved for Binder buffers back to 1MiB now that we have a direct fix for the upstream issue causing more to be required and using a larger virtual memory reservation size appears to have a small chance of failing</li><li>revert our fix for a screenshot process crash that's now fixed upstream in Android 16</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070300">2025070300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070300">2025070300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070100 release:</p><ul><li>increase virtual memory reserved for Binder buffers from 1MiB to 8MiB due to Android 16 having a very large Binder transaction scaling up based on the number of apps and profiles which can go beyond the total size limit and break fully booting the OS, which occurred for a tiny number of our Alpha testers (if you were one of the tiny number of Alpha channel testers running into this, you can <a href="https://grapheneos.org/updates#sideloading">sideload this release</a> to resolve the issue)</li><li>fix issues with display of the end session button to avoid it being wrongly displayed for Owner or not displayed for secondary users (we may remove this part of the upstream end session UI or make it optional since the functionality is also in the power menu)</li><li>update Pixel USB HAL to Android 16 (this was omitted in the initial port due to needing special handling for our USB-C port and pogo pins control feature)</li><li>always use UTC as the time zone for build date properties</li><li>kernel (6.6): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070100">2025070100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070100">2025070100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025063000 release:</p><ul><li>Exynos 5400 modem Pixels (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): temporarily disable hardened_malloc and hardware memory tagging for shared_modem_platform executable due to an upstream write-after-free bug</li><li>Launcher: fix upstream bug causing a crash for the interface to add lockscreen widgets (currently a tablet only feature until Android 16 QPR1)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.63.0">version 138.0.7204.63.0</a></li><li>add debug build functionality for toggling off hardened_malloc usage for vendor processes to make narrowing down issues quicker</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025063000">2025063000</a></h3><p>This is the initial official release of GrapheneOS based on Android 16 after the June 10th release of Android 16. Device support for Pixels was removed from the Android Open Source Project for Android 16 and had to be reimplemented which is why it took so much longer than usual. Please join our <a href="https://grapheneos.org/contact#community-chat">testing chat room</a> if you're interesting in testing this experimental release. We'll be making a series of releases this week to fix several known issues and other issues.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025063000">2025063000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025062700 release:</p><ul><li>full Android 16 port with all GrapheneOS features available (we previously shipped some parts of Android 16 backported to Android 15 QPR2 to provide the 2025-06-05 and then 2025-07-01 Pixel patch level)</li><li>migrate to using adevtool to handle a much larger portion of device support since the Android Open Source Project no longer includes device support for Pixels</li><li>adevtool: add new arcslib infrastructure for extracting resource overlays from the stock Pixel OS</li><li>adevtool: use fixed build number and build date for state regeneration to reduce diffs</li><li>don't disable external ports at boot on debug builds for internal development for debugging early boot failures</li><li>temporarily enable system crash notifications unconditionally for early Android 16 testing</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025062700">2025062700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025062700">2025062700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025062000 release:</p><ul><li>raise security patch level to 2025-07-01 since it's already provided without applying any additional patches</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Pixel 6, Pixel 6 Pro, Pixel 6a: remove AOSP configuration marking android.hardware.location.network as unavailable since it has meant to be declared available since our <a href="https://grapheneos.org/releases#2023062300">2023062300 release</a> adding emulated network location and we also have our own opt-in network location implementation since our <a href="https://grapheneos.org/releases#2025022700">2025022700 release</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.35.0">version 138.0.7204.35.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.0">version 138.0.7204.45.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.1">version 138.0.7204.45.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.2">version 138.0.7204.45.2</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025062000">2025062000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025062000">2025062000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061900 release:</p><ul><li>fix an issue with our added infrastructure for overriding the minimum SDK version for APK-based components backported from Android 16 (Samsung Shannon IMS/RCS was not active resulting in VoLTE, VoNR, VoWi-Fi, SMS via LTE/NR/Wi-Fi and RCS not working so the 2025061900 release was quickly cancelled before being rolled out to a large number of Alpha channel users)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061900">2025061900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061900">2025061900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061600 release:</p><ul><li>full 2025-06-05 Pixel security patch level based on Android 16 backports (full Android 2025-06-05 patch level was provided in an earlier release)</li><li>Pixels: backport Android 16 Wi-Fi firmware, Bluetooth firmware and TPU firmware</li><li>Pixels: backport Android 16 Samsung Radio Interface Layer (RIL) code</li><li>Sandboxed Google Play compatibility layer: fix rare system_server crash reported with Android Auto by adding check for a null calling package</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.115.0">version 137.0.7151.115.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061600">2025061600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061600">2025061600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061500 release:</p><ul><li>partial 2025-06-05 security patch level (Android 2025-06-05 patch level is provided but still only a subset of the Pixel 2025-06-05 patch level due to remaining Android 16 firmware/driver patches being required)</li><li>update to Android 16 kernel drivers and kernel build system to ship the Pixel kernel driver patches from Android 16 while we're still reimplementing device support for Pixels due to AOSP removing it</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061500">2025061500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061500">2025061500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061300 release:</p><ul><li>adjust our hard-wired Android 16 cellular radio version string to pass the case sensitive check done by the install process</li><li>adjust the SUPL disabled mode to work around Samsung gnssd (Pixel 8a and all 9th gen Pixels) not implementing SUPL_MODE properly (reboot is required for the Off mode to kick in on these devices)</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/11">version 11</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061300">2025061300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061300">2025061300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061000 release:</p><ul><li>update SoC and cellular radio firmware to the Android 16 releases to ship the security patches prior to our Android 16 port</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.89.0">version 137.0.7151.89.0</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/10">version 10</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061000">2025061000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061000">2025061000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025060200 release:</p><ul><li>expand our code for checking Google Play Store source stamp signatures to checking each split APK in order to prepare it for future security-relevant usage including optionally marking apps as installed from the Play Store after verifying the source stamp (this is currently used for stripping Play Store inserted checks for apps being installed from the Play Store which had looser security requirements)</li><li>remove Chunghwa Telecom and Netlock Certificate Authorities (CAs) based on <a href="https://security.googleblog.com/2025/05/sustaining-digital-certificate-security-chrome-root-store-changes.html">the decision by the Chrome Root Store</a> (this does not impact Vanadium since it uses a more sophisticated browser root store rather than the OS root store and will distrust certificates from these CAs not added to Certificate Transparency logs before 2025-08-01 to avoid website compatibility issues)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.141</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.72.0">version 137.0.7151.72.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.72.1">version 137.0.7151.72.1</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/9">version 9</a></li><li>Network Location: increase difficulty of position estimation tests to help avoid regressions</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025060200">2025060200</a></h3><p>This is an early June security update release based on the June 2025 security patch backports since the yearly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025060200">2025060200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025060100 release:</p><ul><li>full 2025-06-01 security patch level</li><li>System Updater: temporarily revert notification protection due to upstream Android UI issues for this feature with privileged apps (we still plan to do this but it will need to wait until we resolve the OS issue)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025060100">2025060100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025060100">2025060100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025052800 release:</p><ul><li>Media Provider: expand our existing protection against CVE-2024-50089 which is still not addressed upstream (we added generic hardening in 2022 as a prerequisite for Storage Scopes which along with fixing information leaks still unfixed upstream blocked exploiting CVE-2024-50089 for the common cases of not granting permissions, granting media permissions or using our Storage Scopes feature but we didn't fully cover "All files access" or the legacy API level equivalent when not using Storage Scopes)</li><li>System Updater: prevent disabling overall notifications due to lack of a use case and many users doing it by accident, but continue allowing disabling the individual notification channels other than the reboot notification</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.92</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/8">version 8</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.61.0">version 137.0.7151.61.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025052800">2025052800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025052800">2025052800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025052000 release:</p><ul><li>disable anti-competitive code being injected by the Play Store into apps choosing to enable "App integrity &gt; Automatic protection" when there's a valid Play Store source stamp signature (proving that it's an unmodified app from the Play Store, so we aren't disabling an integrity check) since it prevents using the apps on GrapheneOS when apps also choose to enable "App integrity &gt; Store listing visibility" with either the "Device integrity checks" or "Strong integrity checks" values enforcing having a device licensing Google Mobile Services and running the stock OS (circumventing this is protected by the DMCA exemption for jailbreaking)</li><li>Private Space: fix further issues with quiet/locking state changes in secondary users</li><li>extend NFC auto-turn-off to work when logged into a secondary user</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.140</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.44.0">version 137.0.7151.44.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.44.1">version 137.0.7151.44.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025052000">2025052000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025052000">2025052000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025051900 release:</p><ul><li>Private Space: set correct state on user start or stop for secondary users</li><li>Private Space: make sure nested profiles in secondary users have their storage put at rest when the parent profile's session is ended</li><li>Keyboard: remove dedicated language switch key from the phone layout since it's already shown by the OS itself and uses up too much space with the emoji key already next to the space bar</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025051900">2025051900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025051900">2025051900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050700 release:</p><ul><li>add NFC auto-turn-off setting to go along with the existing addition of Wi-Fi and Bluetooth auto-turn-off settings</li><li>Private Space: add new setting for disabling delayed locking of storage to make locking work like secondary user end session feature we enable, similar to the toggle we add for disabling secondary users running in the background (standard Private Space doesn't work this way to keep fingerprint unlock available after it's locked/stopped)</li><li>Private Space: add new setting for blocking sharing the clipboard to and/or from the parent profile and other nested profiles within it</li><li>Private Space: add support for the Install available apps feature we currently enable to support installing apps available in the Owner user to secondary users</li><li>Private Space: add support for secondary users including all standard features with the exception of auto-locking support since our implementation of that is too complex/invasive to properly review and test while we're focused on Android 16 porting</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.138</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.89</li><li>Keyboard: move the emoji key to the left of the space bar for the phone layout instead of putting it behind a long press or replacing the enter key with it when put into the emoji mode by apps like AOSP Messaging</li><li>Keyboard: stop replacing the emoji key with the .com key for the email and URL input types</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.125.0">version 136.0.7103.125.0</a></li><li>add support for testing Android 16 Beta 4.1 feature flags for development builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050700">2025050700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050700">2025050700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050500 release:</p><ul><li>full 2025-05-05 security patch level</li><li>rebased onto BP1A.250505.005.D1 Android Open Source Project release</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.87.0">version 136.0.7103.87.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050500">2025050500</a></h3><p>This is an early May security update release based on the May 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050500">2025050500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050300 release:</p><ul><li>full 2025-05-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050300">2025050300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050300">2025050300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025042500 release:</p><ul><li>extend security state manager service to support the official Auditor release (based on the signing key) obtaining additional security state (currently the configuration for auto-reboot, USB-C port and pogo pins control, OEM unlocking and user count)</li><li>Auditor: add default enabled data saver exemption</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to synchronous mode for the Hardware Tag-Based KASAN implementation to improve security and error reporting (we'll continue using asymmetric mode in userspace where it provides very comparable security and error reporting to synchronous mode with lower overhead)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): revert upstream Linux kernel change attempting to work around frame drops caused by a workaround used by video players on X11-based platforms (irrelevant to Android) due to it breaking DisplayPort alternate mode audio</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.88</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/89">version 89</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/29">version 29</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/30">version 30</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.60.0">version 136.0.7103.60.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-157">version 157</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-158">version 158</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025042500">2025042500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025042500">2025042500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025041100 release:</p><ul><li>Bluetooth: backport upstream fixes for compatibility with certain Bluetooth peripherals caused by a recent security fix for Bluetooth encryption</li><li>avoid granting special runtime permissions (Network, Sensors) added by GrapheneOS when unarchiving an app</li><li>use our restricted setting infrastructure to restrict system app access to our notification forwarding setting too</li><li>Settings: prevent disabling system Dialer app since it's always required for emergency calls</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.134</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.87</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.100.0">version 135.0.7049.100.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.111.0">version 135.0.7049.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.44.0">version 136.0.7103.44.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025041100">2025041100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025041100">2025041100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025040700 release:</p><ul><li>full 2025-04-05 security patch level</li><li>rebased onto BP1A.250405.007.D1 Android Open Source Project release</li><li>remove code for Qualcomm XTRA (PSDS) privacy improvements since we no longer have any devices with Qualcomm GNSS and we can add it back in the future if we need it again rather than porting it forward under the assumption we'll be using it</li><li>fix upstream RecoverySystem.verifyPackage(...) vulnerability (this was not directly exploitable due to there being 2 layers of update package signature verification and downgrade protection, but the first layer of protection should work properly to avoid a vulnerability in the 2nd layer being exploited)</li><li>Android Debug Bridge: more complete fix for upstream use-after-free bug for network-based connections which is being caught by our always enabled hardware memory tagging support for the base OS in hardened_malloc</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.83</li><li>Seedvault: update to 15-5.5 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.79.0">version 135.0.7049.79.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/88">version 88</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/27">version 27</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/28">version 28</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025040700">2025040700</a></h3><p>This is an early April security update release based on the April 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025040700">2025040700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025040400 release:</p><ul><li>full 2025-04-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025040400">2025040400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025040400">2025040400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025032500 release:</p><ul><li>Sandboxed Google Play compatibility layer: remove StatsManager from hidden services and replace that approach with stubbing out all of the methods since Play services recently introduced new code using it that's missing a null check and triggers a null pointer exception which has blocked us from pushing out the newer versions of Play services beyond our App Store's Alpha channel</li><li>Network Location: switch to making at most a single request to the service per position estimation by requesting up to 40 Wi-Fi APs at once</li><li>Network Location: optimize making requests to the service for Wi-Fi AP data</li><li>Network Location: optimize Rust JNI bindings to the point that it no longer causes a noticeable overhead without introducing unsafe code (it could be optimized further with unsafe code to cache more JNI binding work but the difference is insignificant so we don't plan to do it)</li><li>Network Location: use correct Accept header value to more closely match macOS to avoid future compatibility issues</li><li>fix upstream system_server crash from null pointer exception in F2fsUtils</li><li>add infrastructure for more restricted access to global and per-user settings instead of allowing all system apps to read them and all privileged systems apps with the WRITE_SECURE_SETTINGS privileged permission to write them</li><li>further restrict access to all global and per-user settings added by GrapheneOS with our new infrastructure</li><li>replace disabling the unused ADD_USERS_WHEN_LOCKED and ENABLE_EPHEMERAL_FEATURE settings at boot with a new approach of making settings immutable in the code, which we can expand in the future to other problematic settings not used by GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.131</li><li>kernel (6.1): drop revert for upstream USB fix causing DisplayPort alternate mode regression due to another upstream patch successfully fixing it</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.38.0">version 135.0.7049.38.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-155">version 155</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-156">version 156</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025032500">2025032500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025032500">2025032500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025032100 release:</p><ul><li>Network Location: rewrite position estimation in Rust (from Kotlin) with a new algorithm based on Expectation-Maximization (EM) always using 3D (altitude) to provide much better accuracy, robustness and performance (this new 3D implementation performs better than the previous implementation in the 2D mode we were stuck using due to 3D being far too CPU intensive)</li><li>Network Location: improve RSSI-based (signal strength) distance estimation including tuning it separately for 2.4GHz vs. 5GHz/6GHz and take distance variance into account for position estimation (Wi-Fi Round-Trip-Time support will be added in the future for Access Points supporting it)</li><li>Network Location: add support for 6GHz Wi-Fi networks via Reduced Neighbor Report (RNR)</li><li>Network Location: increase the number of closest APs we explicitly request data for from 5 to 15</li><li>Network Location: request data for up to 4 APs at a time instead of only 1 to improve networking efficiency</li><li>Network Location: make our requests more closely match a current macOS release to avoid future compatibility issues and to get Apple's service to provide more than only 2.4GHz networks as nearby networks in response to queries</li><li>Network Location: reduce requesting data for 100 additional nearby Wi-Fi APs down to 8 APs when a decent amount of additional results were returned from a recent request for up to 100 in the past 10 seconds</li><li>backport upstream brightness fluctuation fix from Android 16 Beta 3.1</li><li>Sandboxed Google Play compatibility layer: fix Location Accuracy link with Play services 25.09 and later so we can ship it as an update for users with sandboxed Google Play installed</li><li>Sandboxed Google Play compatibility layer: remove no longer supported "Configure Play Store updates" settings since we always handle updates ourselves via our App Store now</li><li>fix an upstream screenshot process crash in ScrollCaptureController</li><li>Terminal (virtual machine management app): backport upstream improvements including detecting an outdated image to providing an upgrade path and removing the artificial cap on disk resize</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.135.0">version 134.0.6998.135.0</a></li><li>only block installing out-of-band APEX updates on production (user) builds since it's useful for development</li><li>add support for testing Android 16 Beta 3 feature flags for development builds</li><li>begin porting our changes to work with Android 16 feature flags</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025032100">2025032100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025032100">2025032100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025031400 release:</p><ul><li>Sandboxed Google Play compatibility layer: improve support for overriding Gservices flags to avoid situations where our overrides aren't used leading to compatibility issues (this should fix a recent Play services crash that's being reported)</li><li>Sandboxed Google Play compatibility layer: improve support for overriding phenotype flags and fix flag overrides not being applied in some cases</li><li>fix 2 upstream lockscreen layout bugs with split shade used on folding phones (for the inner screen) and tablets</li><li>fix upstream lockscreen layout bug with placement of alarm and Do Not Disturb information</li><li>fix upstream lockscreen layout bug hiding date text when media is playing</li><li>enable support for the new desktop mode as an additional developer option toggle (Pixel Tablet already has this as the main toggle)</li><li>Terminal (virtual machine management app): backport upstream improvements</li><li>System Updater: raise download buffer size</li><li>System Updater: delete update package immediately after completion</li><li>System Updater: fall back to downloading and installing a full update if an incremental (delta) update fails initialization which occurs when a firmware or OS image has been corrupted (extremely rare edge case due to verified boot)</li><li>System Updater: retry faster if installation fails</li><li>System Updater: improve error checking to provide better error messages</li><li>System Updater: close update package zip file earlier</li><li>Network Location: require TLSv1.3 for GrapheneOS services instead of either TLSv1.2 or TLSv1.3</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Seedvault: update to 15-5.4 (will be replaced with a better backup implementation in the future)</li><li>stop disabling inclusion of device diagnostics functionality now that it's available in the Android Open Source Project</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.108.0">version 134.0.6998.108.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025031400">2025031400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025031400">2025031400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025031300 release:</p><ul><li>Sandboxed Google Play compatibility layer: add back default values to the API definitions for our reimplementation of the Google Play location service since dropping them in the previous release (2025031300) broke compatibility with a subset of apps and prevented us moving it past our Alpha channel (all the improvements from the previous release are still present)</li><li>adevtool: fix support for checking stock OS kernel revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025031300">2025031300</a></h3><p>This release greatly improves the experimental virtual machine management app with many backports from the Android Open Source Project main branch. You'll need to install Android's latest Debian-based image in order to continue using it. You'll be prompted to do this at startup after it fails to start with the old setup with an opportunity to back up the data. The data inside it should continue to be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025031300">2025031300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030900 release:</p><ul><li>Sandboxed Google Play compatibility layer: overhaul our default enabled reimplementation of the Google Play location service (location request rerouting) to provide much better compatibility for apps depending on network-based location by always telling apps that the Google Improve Location Accuracy toggle is enabled and providing fallback to GNSS for low power location requests when the OS network location service is disabled as it is by default (unlike Google Play services, which has no fallback, but apps assume users enable the feature)</li><li>fix Storage Scopes related null pointer exception in the permissions manager</li><li>Bluetooth: backport fix for empty adapter name handling in Android 15 QPR2 to avoid crashes when the name is set to an empty value or whitespace</li><li>Terminal (virtual machine management app): backport a large set of improvements including terminal tabs, working port forwarding, GUI support with opt-in GPU hardware acceleration (ANGLE-based VirGL until GPU virtualization support is available), speaker/microphone support and fixes for a bunch of bugs including overly aggressive timeouts</li><li>Settings: add Terminal app toggle to System category when developer options are enabled (requirement will be dropped when it's no longer experimental) so it can be enabled in other users (it's still currently only possible to use 1 instance at a time due to conflicting use of an internal network specific to virtual machine management)</li><li>Pixel 8 Pro, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix support for enabling UWB (ultra wideband) radio by adding missing SELinux policy to avoid the UWB service chain crashing and burning CPU</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.130</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.82</li><li>Seedvault: update to 15-5.3 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.95.0">version 134.0.6998.95.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/83">version 83</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030900">2025030900</a></h3><p>This release adds support for the experimental virtual machine management app introduced in Android 15 QPR2. It currently only provides support for managing a single VM and interacting with it via a WebView-based terminal. Android is in the process of adding support for graphics and GPU acceleration for a future release. For now, it's only available in developer options due to being highly experimental. We don't recommend using developer options on a production device, but you can temporarily enable it to turn on this feature and turn them back off without it being disabled like most developer options. The data inside it should currently be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update. We plan to support choosing other guest operating systems beyond the Debian-based image provided by Android along with taking far more advantage of the virtualization infrastructure.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030900">2025030900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030800 release:</p><ul><li>SystemUI: re-enable migrate_clocks_to_blueprint and communal_hub flags with workarounds for upstream issues when using standard AOSP UI components instead of Pixel OS components</li><li>Android Debug Bridge: fix upstream crash caused by a race condition that sometimes unregistered a closed file descriptor from epoll</li><li>Sandboxed Google Play compatibility layer: fix issue breaking RPC transactions which impacts the Terminal app</li><li>Sandboxed Google Play compatibility layer: add implementation of isGoogleLocationAccuracyEnabled() to the location rerouting implementation always returning true to fix compatibility with apps checking for it</li><li>Sandboxed Google Play compatibility layer: fix definition of IStatusCallback.onCompletion() to slightly improve performance</li><li>allow Terminal app to use WebView JIT since it requires WebAssembly</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.80</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030800">2025030800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030800">2025030800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030700 release:</p><ul><li>SystemUI: temporarily disable migrate_clocks_to_blueprint and communal_hub flags again to avoid upstream Android 15 QPR1 lockscreen layout regressions which are still present in Android 15 QPR2 until we resolve them, which will be prioritized now</li><li>SystemUI: make screenshot sound use sound effects setting again (our change stopped working from the Android 15 QPR2 port)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030700">2025030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030700">2025030700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030500 release:</p><ul><li>Wallpaper Picker: backport upstream fix for an Android 15 QPR2 bug causing the UI for picking the wallpaper to be blank</li><li>fix upstream system_server crash introduced in Android 15 QPR2 related to Bluetooth telephony integration</li><li>backport upstream fixes for 13 different system_server null pointer exception crashes, an array out of bounds system_server exception and an NFC resolver activity null pointer exception</li><li>backport upstream fix for voice volume adjustments in certain apps</li><li>adevtool (Pixel Tablet): remove unintentional deviation from standard memory pinning configuration</li><li>adevtool: remove unnecessary PersistentBackgroundServices app</li><li>adevtool: filter out config_pluginAllowlist SystemUI overlay to avoid breaking the clock layout by referring to non-AOSP SystemUI clocks</li><li>Sandboxed Google Play compatibility layer: fix Google Play Services for AR not being installable from the Play Store anymore</li><li>Sandboxed Google Play compatibility layer: fix development option for installing the Pixel Thermometer (Pixel Health) app</li><li>add inet group for vmnic (virtual machine networking functionality) to make it compatible with our group-based Network permission enforcement used as another layer of security</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/82">version 82</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030500">2025030500</a></h3><p>This release is based on Android 15 QPR2, the second quarterly release of Android 15. All of the supported devices are now using the Linux 6.1 LTS branch so the 5.10 and 5.15 branches are retired for GrapheneOS. 6.6 continues to be used for microdroid virtual machines on devices and for emulator builds, which will likely move to 6.12 this year.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030500">2025030500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030300 release:</p><ul><li>full 2025-03-05 security patch level</li><li>rebased onto BP1A.250305.020.T2 Android Open Source Project release (initial Android 15 QPR2 release)</li><li>Settings: replace our approach to making the Unrestricted battery mode more visible due to changes in Android 15 QPR2</li><li>drop 8 downstream GrapheneOS patches for upstream Android bugs which should no longer be required due to upstream fixes in Android 15 QPR2</li><li>kernel (Pixel 7a): temporarily disable RANDSTRUCT due to a Qualcomm Wi-Fi driver incompatibility (only the Pixel 7a uses Qualcomm Wi-Fi and RANDSTRUCT wasn't enabled before Android 15 QPR2 for 6th/7th/8th gen Pixels since they weren't on 6.1 yet)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030300">2025030300</a></h3><p>This is an early March security update release based on the March 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR2) scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030300">2025030300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030200 release:</p><ul><li>full 2025-03-01 security patch level</li><li>Network Location: temporarily disable using altitude in trilateration for now because 3D trilateration is using an excessive amount of CPU time and we need to greatly optimize it with algorithm level improvements, porting it to Rust and other optimizations before we can use 3D</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/29">version 29</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/30">version 30</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030200">2025030200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030200">2025030200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030100 release:</p><ul><li>Sandboxed Google Play compatibility layer: remove requestLocationSettingsDialog() implementation due to apps implicitly depending on it behaving in a very specific way</li><li>Sandboxed Google Play compatibility layer: add isHybridLocationServiceEnabled() API</li><li>Sandboxed Google Play compatibility layer: skip redundant location settings check activity when rerouting is on</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030100">2025030100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030100">2025030100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025022800 release:</p><ul><li>Network Location: improve integration of altitude into trilateration to properly account for not all networks providing it including avoiding an edge case null pointer exception</li><li>Network Location: add default enabled data saver exemption</li><li>Network Location: use hideFromAppOps as documented by the Android API documentation for a network location service to match how the AOSP satellite-based location services and the Play services location services in the stock OS work (this likely avoids the need for the exemption from the GrapheneOS location indicator but we're keeping that for now to avoid wasting development time determining it)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025022800">2025022800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025022800">2025022800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025022700 release:</p><ul><li>restrict "5G only" mode to carriers with 5G standalone support to avoid setting the option silently failing</li><li>fix ancient upstream bug causing system_server crashes when flushing an inactive location provider which was uncovered by us adding our own network location provider</li><li>exclude network location provider from the GrapheneOS location indicator since it's meant to be shown for apps requesting location rather than showing users when the OS location services listen for GNSS satellite broadcasts and scan nearby networks</li><li>Sandboxed Google Play compatibility layer: fix issues in our requestLocationSettingsDialog() implementation which were uncovered by providing our own network location provider (this is part of our reimplementation of the Google Play location service used when rerouting Google Play location requests to the OS is enabled which is the default)</li><li>Network Location: add built-in battery optimization exception to avoid being blocked from accessing the network from the background in some cases</li><li>Network Location: incorporate altitude into trilateration when available to replace basic altitude support based on averages which wasn't taken into account for the latitude/longitude estimation (i.e. it now operates in 3D instead of 2D)</li><li>Network Location: add TLS key pinning for gs-loc.apple.grapheneos.org</li><li>kernel (6.6): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025022700">2025022700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025022700">2025022700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025021100 release:</p><ul><li>add opt-in GrapheneOS network location implementation available via Settings &gt; Location &gt; Location services based on using the Apple Wi-Fi positioning API either through a GrapheneOS proxy or directly via Apple's service, which will be extended with much more functionality in the near future including incorporating altitude into trilateration, using cell towers if it provides a better estimate than Wi-Fi and using our own network location database either via a service or offline database downloads (we're in the process of building our own database initially based on collecting most of the data from Apple's service and have already done a test run obtaining essentially all the cell tower data along with lots of Wi-Fi data)</li><li>fix Wi-Fi APEX issues preventing an OS network location service from doing Wi-Fi scans without the INTERACT_ACROSS_USERS / INTERACT_ACROSS_USERS_FULL privileged permissions</li><li>Sandboxed Google Play compatibility layer: add support for using an OS network location provider for the default enabled rerouting of Google Play location requests to the OS location service</li><li>add support for "5G only" and "4G or 5G only" modes in addition to our existing "4G only" mode</li><li>enable support for blocking callers not in Contacts</li><li>resolve regression for secondary user SMS in Android 15 QPR1 by enabling partial upstream fix since we dropped this part of our fix for the issues but the upstream fix wasn't actually active</li><li>fix Storage Scopes / Contact Scopes app settings link not working for apps in nested profiles in some cases</li><li>Launcher: limit 4x5 grid option to phones</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.79</li><li>backport mainline APEX module patches for DocumentsUI, Media Provider and Network Stack</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.89.0">version 133.0.6943.89.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.121.0">version 133.0.6943.121.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.137.0">version 133.0.6943.137.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.39.0">version 134.0.6998.39.0</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/27">version 27</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/28">version 28</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/5">version 5</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/6">version 6</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/7">version 7</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/21">version 21</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/22">version 22</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/23">version 23</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/24">version 24</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/25">version 25</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/26">version 26</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/79">version 79</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/80">version 80</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/81">version 81</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025021100">2025021100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025021100">2025021100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020500 release:</p><ul><li>kernel (5.10, 5.15, 6.1, 6.6): zero memory in early boot in case it wasn't zeroed by the OS as part of a clean reboot or shutdown since there isn't fully encrypted RAM with a per-boot key yet (early boot zeroing is implemented by Pixel boot firmware since April 2024 for booting into fastboot mode but not booting into the OS since they only partially implemented our January 2024 reset attack protection proposal, so we need to handle the OS part ourselves)</li><li>kernel (6.1): add back revert for upstream Linux kernel fix which was reapplied in our <a href="https://grapheneos.org/releases#2025020200">2025020200</a> release without any reports of issues for days because it has been found to break DisplayPort alternate mode on 9th generation Pixels</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.128</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.76</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): backport Wi-Fi driver patch from Android 15 QPR2 Beta 3 in an attempt to avoid a rare invalid read-after-free detected by hardware memory tagging</li><li>Launcher: add 4x5 grid option</li><li>remove infrastructure for our legacy software-based USB peripheral blocking since we've replaced it with <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control">a far better feature using both hardware and software USB connection/data blocking</a> across all supported devices</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/78">version 78</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020500">2025020500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020500">2025020500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020300 release:</p><ul><li>full 2025-02-05 security patch level</li><li>rebased onto AP4A.250205.002 Android Open Source Project release</li><li>drop our workaround for upstream audio routing permission bug impacting Android Auto and likely other apps that's no longer required due to an upstream fix in the monthly February release</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to Mali GPU kernel driver from Android 15 QPR2 Beta 3 to include additional security fixes</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.49.0">version 133.0.6943.49.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-154">version 154</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020300">2025020300</a></h3><p>This is an early February security update release based on the February 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020300">2025020300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020200 release:</p><ul><li>full 2025-02-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020200">2025020200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020200">2025020200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025012700 release:</p><ul><li>reimplement our fix for an upstream audio routing regression in Android 15 QPR1 impacting sandboxed Android Auto and likely other apps to avoid blocking another subset of apps from changing audio routing when granted permission</li><li>Sandboxed Google Play compatibility layer: add support for enabling Google's credential service via Settings &gt; Passwords, passkeys &amp; accounts by making it function as an unprivileged service (non-Chromium-based apps tend to require this to use Google as the passkey service and it's needed by certain apps for their Sign in with Google option despite Android intending to fully support other credential services)</li><li>Sandboxed Google Play compatibility layer: allow disabling all Play Integrity API notifications instead of only disabling them per-app</li><li>Sandboxed Google Play compatibility layer: override Play services update owner value to the GrapheneOS App Store to fully handle updates for it ourselves</li><li>work around upstream Android issue caused by an optimization which was adding a 10 second delay to certain setting changes before they kick in for background system packages</li><li>kernel (5.15): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.126</li><li>kernel (6.1): drop revert for upstream USB fix causing DisplayPort alternate mode regression to test if it's still needed due to lots of other backported changes</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.74</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.39.0">version 133.0.6943.39.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.39.1">version 133.0.6943.39.1</a></li><li>remove same version ABI stability check not useful for GrapheneOS</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025012700">2025012700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025012700">2025012700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025012600 release:</p><ul><li>fix regression in the previous release for configuring per-app settings added by GrapheneOS for apps in the work profile or Private Space when the Settings app is launched from the Owner user rather than the work profile or Private Space (this was caught during Alpha channel testing and is why it didn't proceed to Beta channel testing)</li><li>avoid Settings app crashing when opening the per-app Play Integrity API menu for an already uninstalled app via a leftover notification</li><li>Sandboxed Google Play compatibility layer: improve Play Integrity API description</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025012600">2025012600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025012600">2025012600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025011500 release:</p><ul><li>disable standard Android feature holding a 10 minute screen wake lock after the screen brightness is raised at least 2 times within 5 minutes since this is confusing for users and it's far better if keep awake is done explicitly</li><li>always show Linux kernel crash notifications from hardware memory tagging (Hardware Tag-Based KASAN) instead of only when system crash reporting is enabled by users</li><li>Messaging: begin under the hood overhaul including fully porting to target API 35 (Android 15)</li><li>recovery: remove spurious warning after sideloading an update fails on A/B update devices</li><li>change build username and hostname to match the stock Pixel OS format instead of setting both to grapheneos due to bad actors using it to ban using GrapheneOS</li><li>return green as the value of ro.boot.verifiedbootstate for user installed apps (not the base OS or system apps) due to bad actors using it to ban using GrapheneOS</li><li>SettingsIntelligence: don't show preference summaries in search results since it doesn't work properly for ones depending on dynamic string formatting and isn't done by SettingsIntelligenceGoogle on the stock Pixel OS</li><li>Contact Scopes: fix spoofing of OP_GET_CONTACTS for apps not requesting WRITE_CONTACTS</li><li>Sandboxed Google Play compatibility layer: improve infrastructure</li><li>Sandboxed Google Play compatibility layer: allow blocking the Sandboxed Google Play is running notification</li><li>Sandboxed Google Play compatibility layer: add per-app Play Integrity menu in the per-app Settings configuration that's shown after an app uses the Play Integrity API</li><li>Sandboxed Google Play compatibility layer: add per-app toggle for blocking using the Play Integrity API via the per-app Play Integrity menu as a workaround for apps which ban devices based on it but don't require providing it to their service yet</li><li>Sandboxed Google Play compatibility layer: add shortcut to the per-app Play Integrity API menu for contacting the app developer by leaving a review through the Play Store page</li><li>Sandboxed Google Play compatibility layer: add menu for viewing all apps which have used the Play Integrity API with a shortcut in the per-app Play Integrity API menu</li><li>Sandboxed Google Play compatibility layer: show optional notification upon detection of Play Integrity usage providing a shortcut to the per-app Play Integrity API menu and another for hiding further notifications for the app which is also available as a toggle in the per-menu</li><li>hardened_malloc: update libdivide to 5.2.0</li><li>TalkBack (screen reader): update dependencies</li><li>TalkBack (screen reader): make builds fully reproducible by removing the use of __DATE__ and __TIME__ by brltty along with making the liblouis translation table zip use deterministic file order and timestamps</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.124</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.68</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.0">version 132.0.6834.79.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.1">version 132.0.6834.79.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.2">version 132.0.6834.79.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.122.0">version 132.0.6834.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-153">version 153</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025011500">2025011500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025011500">2025011500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025010700 release:</p><ul><li>fix upstream Android lockscreen bug triggered by the combination of fully disabling animations (via Settings &gt; Accessibility &gt; Color and motion &gt; Remove animations) and enabling always-on display (Settings &gt; Display &gt; Lock screen &gt; Always show time and info) which results in the locking process getting stuck and not considering the device locked until it wakes again due to not skipping animations as intended (this did not create a lockscreen bypass but did result in valid biometric unlock credentials skipping restrictions)</li><li>add protection against upstream lockscreen bugs bypassing restrictions on biometric unlocking while the device is asleep including the standard restrictions and our recently added 2-factor fingerprint unlock feature</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): enable hardware memory tagging for the main kernel allocators via the upstream Hardware Tag-Based KASAN implementation (which is intended for production usage, unlike the other KASAN modes)</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch KASAN fault handling from report to panic to use it as a hardening feature instead of only a bug finding tool</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch KASAN hardware memory tagging mode from synchronous to asymmetric for the initial deployment to reduce the performance cost and match our existing hardware memory tagging usage in userspace (synchronous mode is potentially more useful in the kernel than it is for userspace which is something we can investigate and potentially offer as an option)</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): disable our slab canary feature since it's incompatible with the kernel's hardware memory tagging and will be fully obsolete after we've made basic improvements to the upstream hardware memory tagging implementation</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.233</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.176</li><li>kernel (5.15): merge latest GKI tag to incorporate important security and other patches including the patch for CVE-2024-56556 which are not included in the latest kernel.org release (5.15.176) or the latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Updater: require TLSv1.3 instead of either TLSv1.2 or TLSv1.3</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>System UI Tuner: opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bug)</li><li>make eng builds more consistent with user/userdebug builds by extending the GrapheneOS additions of the ro.control_privapp_permissions=enforce, net.tethering.noprovisioning=true and ro.sys.time_detector_update_diff=50 system properties to all build variants</li><li>show a system error notification for privileged permission allowlist violations in development builds (userdebug and eng builds) instead of breaking booting the device to make developing device support and porting to new OS versions easier</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025010700">2025010700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025010700">2025010700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024123000 release:</p><ul><li>full 2025-01-05 security patch level</li><li>rebased onto AP4A.250105.002 Android Open Source Project release</li><li>provide standard haptic feedback for fingerprint authentication success when 2nd factor PIN is enabled</li><li>add workaround for upstream SystemServiceManager.newTargetUser null pointer exception bug crashing system_server</li><li>add workaround for upstream BatteryStatsImpl.updateWifiBatteryStats divide by zero bug crashing system_server</li><li>Contacts: improve dark theme contrast for empty contacts list background</li><li>backport mainline APEX module patches for Media Provider, Network Stack and Wi-Fi</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.175</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.123</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.65</li><li>Sandboxed Google Play compatibility layer: fix implementation of getCurrentLocation() to return SUCCESS even when the result is null to avoid some edge case issues</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/76">version 76</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/77">version 77</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.260.0">version 131.0.6778.260.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024123000">2024123000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024123000">2024123000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024121200 release:</p><ul><li>add support for adding a PIN as a 2nd factor to fingerprint unlock to enable our new recommended high threat model configuration of a random diceware passphrase as the primary unlock method and fingerprint+PIN with a random 4-6 digit PIN as the regularly used secondary unlock method (the usual limitations of secondary unlock only being usable for 48 hours after successful primary unlock and our limit of 5 total secondary unlock attempts apply)</li><li>add support for limiting charging the battery to 80% with support for bypass charging similar to the new Android 15 QPR1 stock Pixel OS feature, although unlike the stock Pixel OS our implementation still works while using a secondary user (the limit is currently hard-wired to 80% due to that being what's fully supported for the stock OS usage, but we can eventually make it configurable)</li><li>add support for disabling dynamic code loading via storage for all user installed apps by default as we already do for the dynamic code loading via memory setting instead of only being able to opt-in to the restriction on a per-app basis</li><li>allow dynamic code loading from storage by default for apps depending on Play services due to the legacy dynamite module implementation not yet being fully replaced by split APKs to avoid users encountering a huge number of issues if they disable it by default for user installed apps (users can still disable it for these apps manually and we won't need to keep this exception forever since Google is moving to split APKs for dynamite modules)</li><li>add support for partially recompiling apps (speed-profile) in the Finalizing step of OS updates to skip partially recompiling them during boot, but while still doing most of the work after boot in the background (speed) to avoid slowing down OS update installation too much</li><li>remove adding back boot-time display of app compilation progress now that it's no longer heavily used</li><li>use 2 threads instead of 1 for background compilation of apps</li><li>switch to the new upstream default of 4 threads for compiling apps during boot instead of our previous 2 threads which we set to replace the previous upstream default of a single thread</li><li>Settings: add back battery optimization settings link to Battery screen which was removed by Android a long time ago</li><li>Settings: don't disable App info &gt; Battery usage item while its summary is loading</li><li>Settings: temporarily stop showing battery usage info in App info item summary due to an upstream regression causing it to take more than 5 seconds to load in many cases</li><li>add back our fix for an upstream Android bug causing null pointer exception system_server crash in InputMethodManagerService triggered when ending user sessions because it turns out to still be required after Android 15 QPR1</li><li>fix upstream Android bug causing null pointer exception system_server crash in NotificationManagerService</li><li>Contacts: improve dark theme color contrast</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.232</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.173</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.119</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.61</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): fix very minor Android 15 QPR1 regression causing the kernel commit hash to be omitted from the kernel version string and the Unix epoch to be used as the build time instead of the kernel commit timestamp</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/75">version 75</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.200.0">version 131.0.6778.200.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-152">version 152</a></li><li>add developer option to log binder transactions</li><li>fix ignoring harmless fingerprint-service.goodix crash for our system service crash reporting</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024121200">2024121200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024121200">2024121200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120900 release:</p><ul><li>SystemUI: disable migrate_clocks_to_blueprint and communal_hub flags to avoid upstream Android 15 QPR1 lockscreen layout regressions</li><li>fix upstream bug causing the Microphone (RECORD_AUDIO) permission to be required for for local audio routing via REMOTE_SUBMIX instead of only the MODIFY_AUDIO_ROUTING permission with this explicit purpose (this caused Android Auto to require the Microphone permission for routing audio on both the stock OS and GrapheneOS, but it impacts GrapheneOS more due to permissions not being granted by default to Android Auto and most people not wanting to give it the Microphone permission)</li><li>Settings: show current app battery usage mode in summary of App battery usage item</li><li>Settings: add back Unrestricted battery usage option to App battery usage screen to undo the usability regression introduced by Android 14 QPR2 where Optimized vs. Unrestricted was hidden away in an inner mode accessed by pressing the text next to an allow background toggle for controlling the Restricted mode (they likely did this to discourage users enabling Unrestricted, but GrapheneOS users need this much more than stock OS users especially if they don't use sandboxed Google Play and the new UI is very confusing/misleading instead of simply giving users a direct choice between the 3 modes)</li><li>Dialer: add proper dark mode support for dialogs</li><li>Android Debug Bridge: fix upstream use-after-free bug for network-based connections which is being caught by our always enabled hardware memory tagging support for the base OS in hardened_malloc</li><li>Android Debug Bridge: backport support for v4 signatures in streaming app installs from Android's development branch to support updating GrapheneOS apps directly with the streaming-based ADB install commands instead of needing to push them to the device and then install them (this stopped working after Android 15 since we had to replace signed fs-verity metadata with v4 signatures for our implementation of extending verified boot to system APK updates to close a major security hole in standard Android verified boot)</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.135.0">version 131.0.6778.135.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120900">2024120900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120900">2024120900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120702 release:</p><ul><li>Sandboxed Google Play compatibility layer: fix Android Auto Bluetooth audio regressions from Android 15 QPR1</li><li>CarrierConfig2 (app created by GrapheneOS to replace Google CarrierSettings): add support for new ICCID MVNO type in Android 15 QPR1</li><li>CarrierConfig2: add support for new ApnItem fields Android 15 QPR1</li><li>CarrierConfig2: change user-facing carrier settings version string prefix to match Google Carrier Settings to avoid confusion when comparing to the stock OS</li><li>delay activation of the Allow button for the Android Debug Bridge USB authorization dialog by 1 second to make it much harder to accidentally grant access</li><li>Permission Controller: delay activation of the Allow button(s) for runtime permission dialogs by 1 second to make it much harder to accidentally grant access</li><li>Permission Controller: disable all caps text theme by default to match the Settings app style</li><li>Permission Controller: move "Turn off" action from overflow menu to the toolbar for both Storage Scopes and Contact Scopes</li><li>Permission Controller: fix Contact Scopes UI issue where "Allow" could still be selected in the permission menu with Contacts Scopes enabled which would not actually disable Contact Scopes and allow the permission</li><li>Settings: add a dedicated App info &gt; Storage &gt; Manage storage button for apps with a manage storage space activity instead of replacing the standard user interface with it especially since the app's own implementation may not support clearing all storage and may not work at all</li><li>Settings: fix minor back navigation issue for our duress PIN/password UI where it would open a new authentication activity instead of going back to the previous screen</li><li>prevent crashes caused by upstream Android bugs when a Mock Location provider is added or removed by avoiding ever removing location providers at runtime by keeping them around as disabled providers</li><li>stop temporarily always enabling system crash notifications since the initial Android 15 QPR1 testing is completed</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.228</li><li>adevtool: update carrier_settings and carrier_list protobuf parsers for Android 15 QPR1</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120702">2024120702</a></h3><p>This release is specific to 9th generation Pixels and is being published to provide a proper fix for the GPU driver regression we ran into with Android 15 QPR1 so we can switch back to the standard GrapheneOS Linux 6.1 GKI LTS branch.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120702">2024120702</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024120701 release:</p><ul><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch back to standard GrapheneOS 6.1 kernel based on 6.1.118 instead of the tag based on 6.1.84 for AOSP and the stock OS which was used as a workaround for a Mali GPU kernel driver bug in the previous OS release</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to Mali GPU kernel driver from Android 15 QPR2 Beta 1 which includes a fix for the massive mmap bug which caused lag and both app/system wide stalls/crashes with a newer LTS kernel revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120701">2024120701</a></h3><p>This release is specific to 9th generation Pixels and is being published to provide a temporary workaround for a major Mali GPU kernel driver issue introduced in Android 15 QPR1. The issue was caught during our Alpha channel testing and resulted in the last release being cancelled for 9th generation Pixels.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120701">2024120701</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024120700 release:</p><ul><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): temporarily switch to a dedicated GKI kernel branch based on the much older revision used by the stock OS and AOSP (6.1.84 instead of 6.1.118) to resolve major Mali GPU kernel driver regressions, which can then be narrowed down further after we have an initial workaround for the crashes/stalls caused by the driver changes</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120700">2024120700</a></h3><p>This release is based on Android 15 QPR1, the first quarterly release of Android 15.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120700">2024120700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120400 release:</p><ul><li>full 2024-12-05 security patch level</li><li>rebased onto AP4A.241205.013 Android Open Source Project release (December quarterly release of Android 15)</li><li>temporarily always enable system crash notifications to help users find Android 15 QPR1 regressions</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.227</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.1): add back one of the two f2fs defragmentation patches we reverted now that it's backported in Android 15 QPR1, since the other change was the source of the major regression rather than this one and it now has broad testing upstream without the broken change we still have reverted</li><li>kernel (Pixel Tablet): make SYN43752 Wi-Fi/Bluetooth driver build reproducible by dropping Broadcom's inclusion of the absolute path to the build directory as we've already done for all other 6th/7th/8th generation Pixels</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): make BCM4390 Wi-Fi/Bluetooth driver build reproducible by dropping Broadcom's inclusion of the absolute path to the build directory as we've already done for 6th/7th/8th generation Pixels</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120400">2024120400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120400">2024120400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120200 release:</p><ul><li>Gallery: remove the Delete option for items that represent multiple images since the UI is badly designed and makes it too easy to accidentally delete images, especially since the app doesn't support the Trash API</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.104.0">version 131.0.6778.104.0</a></li><li>switch back to correct APK for Vanadium Config to fix using our full content filter list and to unblock out-of-band updates (this regressed in the <a href="https://grapheneos.org/releases#2024112700">2024112700</a> OS release and was noticed with the new Vanadium release)</li><li>envsetup.sh: reuse BUILD_DATETIME and BUILD_NUMBER from environment to make automation for reproducible builds slightly simpler instead of needing to export them after sourcing envsetup.sh</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120200">2024120200</a></h3><p>This is an early December security update release based on the December 2024 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR1) scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120200">2024120200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024112700 release:</p><ul><li>full 2024-12-01 security patch level</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.118</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.58</li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/20">version 20</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-151">version 151</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024112700">2024112700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024112700">2024112700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024111800 release:</p><ul><li>Settings: revert our previous attempt at disabling Bluetooth contact sharing by default for hands-free calling devices in our <a href="https://grapheneos.org/releases#2024111700">2024111700</a> release because it didn't address an upstream Android security bug and having the toggle off by default caused the upstream bug to impact pairing directly in the Settings app (foreground) if the user would have toggled it off instead of only outside the Settings app such as through the Bluetooth Quick Tile (background)</li><li>Settings: fix an upstream Android security bug causing Bluetooth contact sharing to be enabled for hands-free calling devices even though the dialog shows it will be disabled, which only previously occurred for pairing invoked from outside the Settings app but also began impacting pairing from within it due to disabling the contact sharing setting by default</li><li>Settings: always disable Bluetooth contact sharing by default instead of enabling it by default for pairing requests made by the user in the foreground where the user can choose to disable it</li><li>fix upstream bug breaking in-call service components provided by packages only installed in secondary users, which was mainly occurring with user installed Android Auto which unlike the stock OS isn't installed in Owner by default to mask this bug</li><li>Sandboxed Google Play compatibility layer: allow Android Auto foreground services to have while-in-use permissions when wired and/or wireless Android Auto special permissions are granted by the user to fix voice commands in some cases</li><li>Sandboxed Google Play compatibility layer: make Google text-to-speech app queryable by other apps in the same profile by default as it is on the stock OS since libraries using it don't declare the query explicitly (note apps and their libraries can declare any queries they want including for any app with a launcher activity and there's no approval along with there being other ways to detect apps)</li><li>Sandboxed Google Play compatibility layer: show the notification for Play services not having Unrestricted battery usage enabled one more time for existing users since not having it now causes more severe delays FCM push messaging including notifications or more urgent events such as incoming calls to an app like Signal which uses FCM for this when available</li><li>Sandboxed Google Play compatibility layer: add notification about Play services having background data usage restricted which will break FCM when only mobile data is available (no Wi-Fi access)</li><li>Sandboxed Google Play compatibility layer: don't show battery usage notification for Play services when it has the Network toggle revoked since the user clearly doesn't want the functionality depending on Unrestricted background power usage</li><li>Settings: opt-out of Android 15 edge-to-edge for the developer options app picker activity since it's not properly supported yet (upstream bug)</li><li>Setup Wizard: avoid incredibly rare edge case crash (uncaught exception) when trying to disable OEM unlocking when it's already disabled and not allowed to be disabled by the carrier</li><li>fix avoiding reporting harmless fingerprint-related crash with our added crash reporting</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.57</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.81.0">version 131.0.6778.81.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-150">version 150</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024111800">2024111800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024111800">2024111800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024111700 release:</p><ul><li>temporarily revert putting Private Space data at rest when locking it because some users want to be able to unlock it with their fingerprint so we need to make this into a toggle rather than hard-wired (will be added back in a near future release as an option)</li><li>switch default display color mode to Natural for fresh installs for more accurate image/video colors and to avoid bugs tied to the other options</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024111700">2024111700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024111700">2024111700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024110700 release:</p><ul><li>Private Space: put data at rest immediately after stopping the profile to match user profile behavior instead of only on reboot</li><li>fix Mock Location on devices without any standard location providers (only Pixel Tablet)</li><li>backport mainline APEX module patches for ART, DNS Resolver, DocumentsUI, Media, Media Provider, Network Stack, PermissionController, Remote Key Provisioning and Wi-Fi</li><li>raise maximum running users from the standard 3 to 4 for 6GB memory, 6 for 8GB memory, 10 for 12GB memory and 14 for 16GB memory</li><li>Settings: disable Bluetooth contact sharing by default for hands-free calling devices</li><li>Settings: fix Private Space handling in Passwords &amp; accounts &gt; Additional services</li><li>Settings: fix multiple cases of missing user profiles handling for added settings</li><li>Dialer: fix RTT related crash from not using the correct theme configuration</li><li>Contacts Provider: work around upstream bug causing deadlock with contact scopes</li><li>temporarily don't report harmless fingerprint-service.goodix crash</li><li>temporarily disable hardened_malloc for vendor audio service due to Pixel Tablet bug</li><li>Sandboxed Google Play compatibility layer: significantly rework client side compatibility layer to avoid deadlocks and to avoid allowing starting apps with no exported components (i.e. not even a launcher activity)</li><li>Sandboxed Google Play compatibility layer: overhaul approach to raising Google Play components to the foreground to avoid it always being considered in the foreground while also solving an issue triggered in a rare edge case at startup</li><li>Sandboxed Google Play compatibility layer: stop Play Store from attempting to auto-install some system component packages, such as "Android System SafetyCore" (com.google.android.safetycore) and "Android System Key Verifier" (com.google.android.contactkeys)</li><li>Sandboxed Google Play compatibility layer: fix Android Auto voice commands not working in some cases</li><li>Sandboxed Google Play compatibility layer: fix one of the Android Auto permission toggle checks for companion devices</li><li>Sandboxed Google Play compatibility layer: extend opt-in Android Auto "Allow permissions for handling phone calls" toggle to allow access to Bluetooth adapter hardware address access for hands-free audio support with wired Android Auto rather than only wireless Android Auto where the baseline toggle already grants access to that</li><li>Sandboxed Google Play compatibility layer: don't stop apps that use Dynamite modules when Play services stops since the new version of the Dynamite client library handles dynamic re-connection without app restart and older ones will handle this by stopping</li><li>kernel (5.10, 5.15, 6.1, 6.6): disable unused TIPC protocol support</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.170</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.115</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>System Updater: show failure notification for update_engine errors</li><li>System Updater: add missing UpdateEngine.unbind() to avoid extra callbacks for progress and error reporting</li><li>System Updater: avoid treating non-404 errors such as a connection failure as lack of an incremental update</li><li>System Updater: handle a partially downloaded incremental update being removed from the server by falling back to the full update instead of retrying resuming the incremental download until the next update (this will allow us to remove an incremental for the latest available version to save storage space or work around a potential update_engine bug without it causing download resumption errors)</li><li>System Updater: delete stale update from a failed download of a previous release slightly earlier</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.102.1">version 130.0.6723.102.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.39.0">version 131.0.6778.39.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-149">version 149</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024110700">2024110700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024110700">2024110700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024110400 release:</p><ul><li>full 2024-11-05 security patch level</li><li>rebased onto AP3A.241105.007 Android Open Source Project release (November monthly release of Android 15)</li><li>ignore Person.Builder.setUri() when Contact Scopes is enabled since apps can't access the contact's URI with Contact Scopes enabled (this resolves the incompatibility between Contact Scopes and apps attaching contact information to notifications which was introduced by a November Android Security Bulletin patch)</li><li>fix "App info" uninstall dialog link added by GrapheneOS not working in some cases for secondary profile apps</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-147">version 147</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.102.0">version 130.0.6723.102.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024110400">2024110400</a></h3><p>This is an early November security update release based on the November 2024 security patch backports since a monthly Android Open Source Project and stock Pixel OS release hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024110400">2024110400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024103100 release:</p><ul><li>full 2024-11-01 security patch level</li><li>fix a bunch of upstream Android bugs breaking SMS and MMS functionality in secondary profiles, including both Android 15 regressions and pre-existing issues</li><li>backport upstream Android fix for UsageStatsDatabase locking from the AOSP main branch</li><li>Sandboxed Google Play compatibility layer: fix flag overrides being partly ignored on recent versions</li><li>add workaround for rare system_server null pointer exception crash in showShutdownDialog()</li><li>add missing null handling for extended application error report</li><li>fix upstream bug causing App Not Responding link to not work properly outside of Owner</li><li>Settings: avoid opening parent user log viewer in nested profiles (Private Space, work profile)</li><li>System Updater, GmsCompat: reduce included SettingsLib components to reduce the size of these apps from around 10MB each to below 4MB each</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-146">version 146</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024103100">2024103100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024103100">2024103100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102400 release:</p><ul><li>improve our existing fix for an upstream Android bug impacting apps using the telephony service in secondary users to fix support for disabling re-routing of Google Play location requests to the OS for fresh installs of sandboxed Google Play since the release of Android 15</li><li>Sandboxed Google Play compatibility layer: extend wired Android Auto toggle to additional methods used in edge cases</li><li>fix changing USB-C port control setting to a lower security level not fully applying until after locking and unlocking</li><li>Settings: fix per-app exploit protection toggles for Private Space</li><li>Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS</li><li>raise system log buffer size from 256KiB to 512KiB to make logs obtained by users reporting issues more useful</li><li>enable stamp configuration for microdroid kernel builds to set LOCALVERSION based on version control information as expected</li><li>kernel (6.6): disable unused hibernation support</li><li>kernel (6.6): disable unused TIOCSTI ioctl (already blocked via standard Android SELinux ioctl filtering)</li><li>kernel (6.6): disable unused cachestat system call (already blocked for apps via standard Android seccomp-bpf policy)</li><li>kernel (6.6): enable random kmalloc caches for x86_64 and microdroid too, not only bare metal arm64</li><li>kernel (6.6): enable full struct randomization for x86_64 and microdroid too, not only bare metal arm64</li><li>kernel (6.6): enable DEBUG_SG for microdroid too, not only bare metal</li><li>kernel (6.6): enable FORTIFY_SOURCE for microdroid too, not only bare metal</li><li>kernel (6.6): disable BINFMT_MISC for microdroid too, not only bare metal</li><li>kernel (6.6): disable RSEQ for microdroid too, not only bare metal</li><li>kernel (6.6): add SYSRQ restrictions for microdroid too, not only bare metal</li><li>kernel (6.6): use the same KFENCE configuration for microdroid as bare metal</li><li>mark Sensors permission as implicitly added</li><li>avoid adding Sensors permission to hasCode=false packages</li><li>improve our implementation of extending verified boot to out-of-band shared library APK updates</li><li>Log Viewer: add userType line to header in non-Owner users</li><li>Log Viewer: add targetSdk and sharedUid to package info header</li><li>System Updater: update minimum and target API level to 35 (Android 15)</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.86.0">version 130.0.6723.86.0</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/5">version 5</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/87">version 87</a></li><li>Sandboxed Google Play compatibility layer: fix development support in OS debug builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102400">2024102400</a></h3><p>Notice which will not impact most users: apps which were only installed in secondary users but not Owner before updating to Android 15 and which were then installed in Owner after updating to Android 15 will have a one-time revocation of their Network/Sensors permissions after updating to this release as a minor consequence of migrating them from Android 14 again.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102400">2024102400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102100 release:</p><ul><li>switch back our original stricter approach to DNS leak blocking from our <a href="https://grapheneos.org/releases#2024050900">2024050900</a> release with an additional fix for an Android DNS routing bug causing requests to the VPN DNS servers to be routed incorrectly, which should avoid the compatibility issues experienced with certain VPN apps when we tried to ship it before</li><li>avoid resetting Network or Sensors back to the global default after app updates in a specific case when migrating the state from Android 14 or earlier</li><li>add an extra one-time migration of Network and Sensors being disabled in Android 14 to Android 15 to work around an issue with the previous migration of the permission state which occurred for some users with some of their apps</li><li>fix ancient Android bug causing widgets to disappear from the user's home screen when the user stops, which was a major usability issue for secondary users</li><li>Keyboard: extend fix for upstream layout bug in landscape mode to fully fix it for 3-button navigation in addition to the default gesture navigation</li><li>Gallery: fix upstream cropping activity bug when both the input and output URI is the same to fix setting profile pictures for user profiles</li><li>raise backup service transport (Seedvault) timeout from 10 minutes / 5 minutes to 60 minutes / 30 minutes to handle very large backups, particularly for the device-to-device mode which includes nearly all app data</li><li>temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps (revert was not applied for Android 15 port)</li><li>Sandboxed Google Play compatibility layer: add stubs for update_engine wrapper API to avoid potential Play services crashes if the existing approaches to disable the update service fail</li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>use hardened GrapheneOS 6.6 LTS kernel for microdroid virtual machines for both arm64 and x86_64</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.73.0">version 130.0.6723.73.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-144">version 144</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-145">version 145</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102100">2024102100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102100">2024102100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102000 release:</p><ul><li>Keyboard: fix upstream bug triggered by Android 15 causing layout to be cut off in landscape mode on devices with a display cutout</li><li>enforce stack clash protection for arm64</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102000">2024102000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102000">2024102000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101900 release:</p><ul><li>Sandboxed Google Play compatibility layer: adjust one of the stubs for the NearbyManager API to resolve a remaining issue</li><li>Sandboxed Google Play compatibility layer: use per-network MAC randomization and enable send device name for wireless Android Auto networks to avoid introducing compatibility issues by default for certain cars with either our per-connection MAC randomization feature or default disabled DHCP device name</li><li>adjust hasSendDhcpHostnameEnabledChanged() based on new "Send device name" setting value to avoid introducing a permission issue</li><li>temporarily disable memory tagging for the Pixel Camera Services app until memory corruption bugs are resolved</li><li>extend one-time removal of leftover Vanadium library state to handle it for Alpha/Beta users who removed it from Owner themselves but still have it in other users</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101900">2024101900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101900">2024101900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101801 release:</p><ul><li>drop existing "Send device name" setting value for all Wi-Fi networks to start from our default of disabled for all users including people who updated to the Beta and Alpha releases already (we already switched the default to off for new networks in <a href="https://grapheneos.org/releases#2024101800">2024101800</a>)</li><li>limit removal of shared library updates as part of our system APK verified boot feature to those equal to the OS version since older versions are already dealt with and removing them this way leaves behind stale package state cluttering the UI</li><li>run a one-time task to remove leftover Vanadium library state to avoid showing a list of old versions</li><li>Settings: fix upstream Android 15 bug causing a crash for the network privacy menu when the AP name has special characters</li><li>Sandboxed Google Play compatibility layer: add stubs for NearbyManager API to avoid crashes from Find My Device feature</li><li>Dialer: fix new upstream crashes in Android 15 caused by R8 optimization</li><li>fix upstream Android 15 bug causing a Wallet quick tile provided by a user installed app to be automatically added, which isn't intended</li><li>fix upstream Android bug causing crash when showing app's first confirmation prompt for PackageInstaller</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101801">2024101801</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101801">2024101801</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101800 release:</p><ul><li>Sandboxed Google Play compatibility layer: only check for SET_BIOMETRIC_DIALOG_ADVANCED permission for GmsCompat apps to avoid causing crashes elsewhere</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101800">2024101800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101800">2024101800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101701 release:</p><ul><li>stop enabling the new Android 15 "Send device name" toggle for Wi-Fi networks by default to continue avoiding sending the device model (default) or user configured device name as a DHCP client hostname (Alpha channel testers on our previous Android 15 releases need to toggle it off for each existing network themselves if they don't want it)</li><li>Sandboxed Google Play compatibility layer: handle lack of SET_BIOMETRIC_DIALOG_ADVANCED permission</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101701">2024101701</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101701">2024101701</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101700 release:</p><ul><li>Sandboxed Google Play compatibility layer: declare C2DM SEND permission ourselves in addition to the already covered READ_GSERVICES and C2DM RECEIVE to avoid issues with Firebase Cloud Messaging for fresh installs of sandboxed Google Play without the Google Services Framework (GSF) app that's no longer a dependency in our App Store for Android 15</li><li>Settings: enable our per-connection Wi-Fi MAC randomization feature by default for new networks again on Android 15 instead of the standard per-network approach</li><li>Settings: extend change in the previous release for hiding inaccurate Private Space information</li><li>persist GrapheneOS-specific package state when archiving an app</li><li>Radio Info, Wi-Fi testing (Settings): opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bug)</li><li>stop excluding Gallery from Private Space</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101700">2024101700</a></h3><p>This is the second release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. It fixes nearly all of the reported regressions, but we have a couple more things to fix in another release later today before the release will be able to reach Beta and Stable.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101700">2024101700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101600 release:</p><ul><li>fix upstream Android 15 bug in InputMethodManagerService.resetDefaultImeLocked() causing system_server crash from null pointer exception</li><li>fix upstream Android 15 bug in KeyguardUpdateMonitor.onPostureChanged() causing SystemUI crash on foldable devices from null pointer exception due to GrapheneOS currently only having fingerprint unlock and not face unlock</li><li>Messaging: add new permissions needed on Android 15 (READ_CELL_BROADCASTS and RECEIVE_WAP_PUSH) which avoids it prompting to be set as the default app instead of completing certain actions requiring privileges it was missing</li><li>Settings: port our default enabled per-connection MAC randomization option to the new Compose-based UI in Android 15 so the default mode displays properly and it can be restored back to the default value</li><li>fix Android 15 port of our toggle for disabling granting our Sensors permission by default</li><li>Storage Manager, Emergency Info: opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bugs)</li><li>Sandboxed Google Play compatibility layer: replace GmsCompatConfig Bluetooth stubs with in-place checks for improved reliability and readability</li><li>ignore the standard stock OS configured Factory Reset Protection since installing GrapheneOS implies the ability to bypass it via the device being unlocked and if we added our own anti-theft system it would not use the same approach using Google account recovery</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release</li><li>Launcher: remove "Install in private" shortcut for now since the standard behavior of opening the app in the first party app store isn't currently useful on GrapheneOS right now and is confusing to users</li><li>Settings: hide inaccurate "access private space when hidden" text that's not currently relevant to GrapheneOS since AOSP doesn't have this launcher feature yet</li><li>Keyboard: remove launcher icon to avoid it temporarily showing up in new users/profiles (not a recent regression)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-142">version 142</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-143">version 143</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101600">2024101600</a></h3><p>This is the initial release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. We had previously ported all of our features to Android 15 based on the Beta releases and have been finishing it up based on the early September release of the source code for Android 15. Our initial port of all our features was completed on September 3rd and we've been polishing it up while we've been working on regular development.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101600">2024101600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101200 release:</p><ul><li>full 2024-10-05 security patch level since the Pixel patches were disclosed in the Pixel Update Bulletin today</li><li>rebased onto AP3A.241005.015 Android Open Source Project release (Android 15)</li><li>full port of GrapheneOS features to Android 15 including integration of our features with the new Android 15 features including Private Space</li><li>Sandboxed Google Play compatibility layer: add stubs to fully remove the need for the Google Services Framework (GSF) app for fresh installs of sandboxed Google Play, which has been removed as a dependency in our app repository for Android 15+, but it should still be kept for existing installs to avoid potential issues</li><li>Pixel 9 Pro Fold: add assorted device-specific Settings and SystemUI changes to better match the stock OS</li><li>disable Bluetooth auto-on feature by default</li><li>temporarily enable system crash notifications unconditionally for the initial release based on Android 15 release</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.56</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>Seedvault: minor changes to prepare for a complete fork and overhaul in the future</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.58.0">version 130.0.6723.58.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-141">version 141</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101200">2024101200</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200-redfin">2024101200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200">2024101200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200-caimito">2024101200-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024100800 release:</p><ul><li>hardened_malloc: preserve hardware memory tagging enforcement flag for slab mappings when releasing free slabs</li><li>hardened_malloc: improve accuracy of probability hint for hardware memory tagging branches</li><li>temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps</li><li>Log Viewer: add "bootloader unlocked" and "dev options enabled" flags to header</li><li>Log Viewer: add "More info" button to native crash reports</li><li>Log Viewer: include contents of App Not Responding (ANR) stack traces file in ANR error reports</li><li>Log Viewer: omit processUptime header line when it's unknown</li><li>Settings Intelligence (Settings search): fix upstream bug resulting in corruption of the query history database which leads to the search crashing</li><li>Launcher: mark 2x2 workspace option as being for phones</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.54</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.100.0">version 129.0.6668.100.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024100800">2024100800</a></h3><p>This is an early October security update release based on the October 2024 security patch backports since a monthly Android Open Source Project and stock Pixel OS release based on Android 14 QPR3 hasn't been published yet. Android 15 is scheduled for release around October 15th and they may not have a monthly release based on Android 14 QPR3 before then.</p><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800-redfin">2024100800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800">2024100800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800-caimito">2024100800-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024092900 release:</p><ul><li>full 2024-10-01 security patch level</li><li>overhaul the implementation of our USB-C port control feature to improve robustness and error reporting</li><li>fix an upstream Android Bluetooth use-after-free bug uncovered by GrapheneOS hardware memory tagging that's triggered when obtaining internet access from another device via Bluetooth</li><li>fix an upstream Android race condition bug in handling of system error files to avoid using the wrong timestamps for system errors and then reporting them as new errors after reboot</li><li>work around an upstream Android bug causing our Log Viewer feature to stop working after system_server restarts</li><li>add handling for early boot-time system journal notifications</li><li>kernel (5.10, 5.15, 6.1, 6.6): backport upstream patch fixing a hole in SELinux W^X enforcement</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.226</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.167</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.112</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.53</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.81.0">version 129.0.6668.81.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-140">version 140</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024092900">2024092900</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900-redfin">2024092900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900">2024092900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900-caimito">2024092900-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024091900 release:</p><ul><li>extend standard Android eBPF filter to prevent apps sending multicast packets outside of the VPN tunnel either directly or indirectly via kernel-generated multicast traffic (IGMP, MLD) when leak blocking is enabled (2nd generation implementation with improved app compatibility)</li><li>add netfilter-based multicast firewall only permitting sending multicast packets to permitted tunnel interfaces for the process to prevent apps sending multicast packets through a VPN tunnel for another profile (2nd generation implementation with improved IPv6 and app compatibility)</li><li>Sandboxed Google Play compatibility layer: add stub for Bluetooth AdvertisingSetParameters.setOwnAddressType() API needed for receiving files through Quick Share</li><li>Sandboxed Google Play compatibility layer: ignore GattServer in BTLeAdvertiser.startAdvertisingSet() needed for receiving files through Quick Share</li><li>Auditor: add battery optimization exception to avoid delays for the opt-in scheduled remote verification since users rarely interact with the app resulting in it being placed into semi-restricted standby buckets</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/86">version 86</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/26">version 26</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.70.0">version 129.0.6668.70.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-138">version 138</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-139">version 139</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024091900">2024091900</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900-redfin">2024091900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900">2024091900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900-caimito">2024091900-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024091700 release:</p><ul><li>temporarily revert multicast leak blocking firewall due to causing legacy 5th gen devices to lose compatibility with IPv6-only carriers along with causing certain compatibility issues with IPv6 on Wi-Fi</li><li>temporarily revert multicast leak blocking eBPF filter extensions until app compatibility is addressed in a similar way as the Network permission mimics non-security errors</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024091700">2024091700</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700-redfin">2024091700-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700">2024091700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700-caimito">2024091700-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024090400 release:</p><ul><li>Sandboxed Google Play compatibility layer: handle the updated client dynamite module initialization sequence</li><li>extend standard Android eBPF filter to prevent apps sending multicast packets outside of the VPN tunnel either directly or indirectly via kernel-generated multicast traffic (IGMP, MLD) when leak blocking is enabled</li><li>add netfilter-based multicast firewall only permitting sending multicast packets to permitted interfaces for the process to prevent apps sending multicast packets through a disallowed interface such as a VPN tunnel for another profile</li><li>exclude com.android.rkpdapp from backup/restore to avoid breaking key provisioning for hardware key attestation including for Auditor (users can clear RemoteProvisioner system app data via Settings if they restored data for it and have this issue)</li><li>Pixel 9 Fold Pro: temporarily manually add resource overlays not yet automatically handled by adevtool from the stock Pixel OS to use the correct layout for quick settings, status bar, etc. and to provide the split folded/unfolded auto-rotate settings (this will be replaced by adevtool improvements before the end of the month since we'll need it for more resources in Android 15)</li><li>hardened_malloc: fix microdroid virtual machine compatibility by using armv8a+dotprod+memtag when enabling memory tagging instead of armv9+memtag</li><li>init: disable auto-reboot setup for microdroid virtual machines</li><li>expat: backport patches for CVE-2024-28757, CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492 (none of these is exploitable on official GrapheneOS since the DoS bug involves a feature Android doesn't use, the integer overflows require that size_t is 32-bit which is never going to be the case due to the code only being used in 64-bit processes and the negative parameter API issue requires a usage pattern not done by Android, but the integer overflows would be exploitable on an official build for a 32-bit device or a 64-bit device still partially using 32-bit drivers)</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.225</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.165</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.104</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.51</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.127.0">version 128.0.6613.127.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.146.0">version 128.0.6613.146.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.54.0">version 129.0.6668.54.0</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/25">version 25</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/85">version 85</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/4">version 4</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-136">version 136</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-137">version 137</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024090400">2024090400</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400-redfin">2024090400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400">2024090400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400-caimito">2024090400-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024083100 release:</p><ul><li>full 2024-09-05 security patch level</li><li>rebased onto AP2A.240905.003 (generic) and AD1A.240905.004 (caimito) Android Open Source Project releases</li><li>Sandboxed Google Play compatibility layer: add support for using GSF 34 on SDK 35 (Android 15) to handle the case where users have just upgraded the OS but haven't yet updated GSF</li><li>Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix an upstream use-after-free bug present in 2 drivers</li><li>allow Pixel Thermometer and Fitbit to see each other as a special case</li><li>allow current launcher to see the Pixel Thermometer app as a special case</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.47</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-134">version 134</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-135">version 135</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024083100">2024083100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100-redfin">2024083100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100">2024083100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100-caimito">2024083100-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024082200 release:</p><ul><li>don't hide Exploit protection Safety Center item in secondary users</li><li>Settings: improve UI for GrapheneOS app toggles including adding a screen for viewing the values across apps for each toggle</li><li>add more infrastructure for blocking dynamic code loading</li><li>Settings: add per-app memory dynamic code loading restriction toggle (applies to both native code and Android Runtime class loading for Java/Kotlin)</li><li>Settings: add per-app storage dynamic code loading restriction toggle (applies to both native code and Android Runtime class loading for Java/Kotlin), temporarily without a global toggle until Google phases out the old dynamite module system for Google Play due to many apps temporarily depending on this through it</li><li>Settings: add per-app WebView JIT restriction toggle</li><li>add production support for the Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL and Pixel 9 Pro Fold</li><li>add support for enabling app association restrictions without exemptions (currently for use with Pixel Thermometer)</li><li>add support for Pixel Thermometer app available from our App Store for the Pixel 8 Pro, Pixel 9 Pro and Pixel 9 Pro XL with strict isolation from other apps</li><li>add missing feature compatibility matrix definitions (mainly for 9th generation Pixels)</li><li>Contact Scopes: explicitly set initialization order after ContactsProvider2 to avoid uncaught exceptions from a race</li><li>kernel (6.1): disable unused hibernation support</li><li>kernel (6.1, 6.6): enable struct randomization in the full mode with a deterministic seed based on kernel commit timestamp (we plan to also incorporate the device family and eventually make the seed specific to each device model, but it will increase our build/testing workload)</li><li>kernel (6.6): enable random kmalloc caches</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.96</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.46</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.88.1">version 128.0.6613.88.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.99.0">version 128.0.6613.99.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/84">version 84</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-131">version 131</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-132">version 132</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-133">version 133</a></li><li>drop restriction on modifying GrapheneOS-specific per-package settings via ADB shell since it makes certain important testing require debug builds and has no real security value</li><li>flash-all.sh: restore POSIX sh compatibility to allow using sh instead of bash on systems where sh is dash or another non-bash-compatible shell</li><li>add support for using backslashes in the passphrases for encrypting the keys for signing OS releases</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024082200">2024082200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082200-redfin">2024082200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082200">2024082200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024082000 release:</p><ul><li>Settings: fix regression in the previous release which blocked it reaching the Stable channel by making the duress PIN/password configuration unavailable in secondary users again (it was only usable when the secondary user had the same unlock PIN/password as the Owner user)</li><li>adevtool: remove non-functional repair mode support</li><li>adevtool: remove non-functional digital car key support (requires privileged Google Play)</li><li>adevtool: remove invalid clock font family overlay (google-sans-clock font not included)</li><li>adevtool: update carrier settings</li><li>Pixel 8a: add Let's Encrypt (ISRG) roots for Samsung gnssd SUPL connections via adevtool instead to share the implementation with 9th generation Pixels</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/83">version 83</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.88.0">version 128.0.6613.88.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024082000">2024082000</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082000-redfin">2024082000-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082000">2024082000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080600 release:</p><ul><li>Settings: enable Safety Center and port all of the relevant GrapheneOS settings to it both to provide the more modern user interface and to prepare for the release of Android 15</li><li>hide Safety Center camera extensions fallback toggle when it's not relevant (not used on Pixels)</li><li>Package Installer: fix upstream bug causing null pointer exception in rare edge cases including a rare race condition</li><li>require Owner user credential to check whether a duress PIN/password is enabled as hardening against potential UI bugs such as the upstream predictive back gesture issue we patched in the Settings app</li><li>apply upstream change for 6th generation Pixels making snapuserd available in recovery to avoid a problem in a rare edge case where a factory reset occurs before finishing booting a new update</li><li>apply minor upstream fixes for Settings which were temporarily only shipped for certain Pixels</li><li>add fastboot to otatools.zip for optimized factory images generation</li><li>flash-all: raise minimum fastboot version to 35.0.1</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.223</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.164</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.95</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.45</li><li>remove duplicate Android.bp from unpacked otatools.zip to avoid breaking subsequent builds when it's unpacked in the source tree</li><li>add Android 15 Beta build configuration for early development/testing of our Android 15 port via an ap2f release configuration enabling all of the available Android 15 feature flags</li><li>port GrapheneOS changes to new code for Android 15 used by our Android 15 Beta build configuration</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.0">version 127.0.6533.104.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.1">version 127.0.6533.104.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.2">version 127.0.6533.104.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.3">version 127.0.6533.104.3</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-128">version 128</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-129">version 129</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-130">version 130</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080600">2024080600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080600-redfin">2024080600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080600">2024080600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080500 release:</p><ul><li>full 2024-08-05 security patch level</li><li>rebased onto AP2A.240805.005 Android Open Source Project release</li><li>adevtool: update dependencies</li><li>adevtool: improve code quality</li><li>adevtool: use fastboot packs to extract firmware images to avoid the need to download over-the-air updates, which also removes the dependency on python and python-protobuf for extracting vendor files</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.103.0">version 127.0.6533.103.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/74">version 74</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080500">2024080500</a></h3><p>This is an early August security update release based on the August 2024 security patch backports. This month's release of the Android Open Source Project and stock Pixel OS should be available later today or tomorrow and we'll quickly release an update based on it following this one.</p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080500-redfin">2024080500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080500">2024080500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080200 release:</p><ul><li>full 2024-08-01 security patch level</li><li>suppress crash notifications for 2 harmless crashes occuring on service shutdown for the Android Bluetooth service and Pixel wifi_ext service</li><li>enable memory tagging for the Pixel wifi_ext service again</li><li>Settings: disable predictive back gesture in PIN/password input activities to fix an upstream Android vulnerability</li><li>flash-all: remove unnecessary sleep after flashing AVB key</li><li>flash-all: exit on errors</li><li>flash-all.sh: avoid false negative for device model check</li><li>flash-all.bat: pause before exiting after an error</li><li>fastboot: add support for CLI install with the GrapheneOS optimized factory images format already used by the web installer (will reduce memory/storage usage for CLI installs and will reduce storage usage on the update servers by avoiding multiple factory image formats)</li><li>hardened_malloc: update libdivide to 5.1</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.43</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080200">2024080200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080200-redfin">2024080200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080200">2024080200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080100 release:</p><ul><li>prevent VPN apps from having leaks to non-VPN DNS servers while not yet strictly preventing leaks to VPN DNS outside the VPN tunnel due to multiple VPN apps including Proton VPN not connecting reliably with stricter enforcement (in a future release, we can do strict blocking by default with an opt-out toggle and a list of known incompatible apps such as Proton VPN until the compatibility issue is resolved)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-126">version 126</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-127">version 127</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/73">version 73</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080100">2024080100</a></h3><p><strong>This release is only for the Alpha channel to replace the previous release.</strong></p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080100-redfin">2024080100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080100">2024080100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024073100 release:</p><ul><li>revert VPN DNS leak protection again since it's still partially incompatible with Proton VPN and certain other apps for unknown reasons, although we did avoid a lot of the compatibility issues from last time</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024073100">2024073100</a></h3><p><strong>This release was only pushed out to the Alpha channel.</strong></p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024073100-redfin">2024073100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024073100">2024073100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024072800 release:</p><ul><li>add back our change to prevent app-based VPN implementations from leaking DNS requests when the VPN is down/connecting but without enforcement for VPN apps without DNS configured to avoid breaking compatibility in rare cases (our previous implementation in <a href="https://grapheneos.org/releases#2024050900">2024050900</a> had to be reverted before it reached Stable)</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/72">version 72</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.84.0">version 127.0.6533.84.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024072800">2024072800</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024072800-redfin">2024072800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024072800">2024072800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024071600 release:</p><ul><li>avoid isolating eUICC LPA (eSIM activation) app from third party apps to allow carrier activation apps to work (we still block communication with Google Play to avoid sending telemetry data to Google services when sandboxed Google Play is installed)</li><li>Pixel 8a: fix GNSS configuration to avoid occasional crashes of the service (Pixel 8a is currently the only Samsung GNSS device)</li><li>Settings: don't allow disabling user installed apps when uninstall is disallowed</li><li>Settings: drop code for supporting the legacy Settings UI</li><li>Sandboxed Google Play compatibility layer: avoid infinite wait for GmsCompatConfig update when call to App Store fails</li><li>enforce stack clash protection for x86_64</li><li>enforce minimum 64kiB stack guard size for arm64 due to the standard stack probe size of 64kiB</li><li>future proof our Bionic libc changes for dynamic 64k pages (hardened_malloc still doesn't support it)</li><li>flash-all: remove unnecessary reboot after flashing Android Verified Boot (AVB) key</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.222</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.163</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.92</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.42</li><li>adevtool: update to latest carrier settings</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/24">version 24</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/69">version 69</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/70">version 70</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/71">version 71</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/81">version 81</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/82">version 82</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.64.0">version 127.0.6533.64.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.64.1">version 127.0.6533.64.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-124">version 124</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-125">version 125</a></li><li>fastboot: add support for generating web installer optimized factory images zip for an improved web install approach not requiring fastbootd</li><li>integrate generating web installation optimized factory images zip into release signing script</li><li>split script/release.sh to remove dependency on build output and the OS source tree (see the new instructions for signing releases)</li><li>rename script/release.sh to script/generate-release.sh</li><li>add script/generate-releases.sh wrapper script</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024071600">2024071600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071600-redfin">2024071600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071600">2024071600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024071200 release:</p><ul><li>fix touch-to-unlock setting on devices with a power button fingerprint scanner (Pixel Fold, Pixel Tablet) which is normally always active with AOSP</li><li>avoid race for setting USB port mode when the lock method is set to none (lockscreen disabled)</li><li>Pixel Tablet: add non-standard toggle for enabling touchscreen frequency hopping to reduce ghost touches for users with problematic touchscreen hardware</li><li>kernel (5.10, 5.15): revert a USB change backported to kernel.org LTS that's causing DisplayPort alternate mode compatibility issues</li><li>Pixel 8a: fix GNSS configuration to avoid occasional crashes of the service (Pixel 8a is currently the only Samsung GNSS device)</li><li>backport mainline APEX module patches for Media Provider, Network Stack, Remote Key Provisioning and Wi-Fi</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.221</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.161</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-123">version 123</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024071200">2024071200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071200-redfin">2024071200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071200">2024071200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070900 release:</p><ul><li>kernel (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a): temporarily revert disabling 32-bit ABI support due to rare cases of apps using a buggy anti-tampering library incorrectly calling 32-bit versions of system calls from 64-bit code even on devices with no 32-bit support in hardware</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.160</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.38</li><li>TalkBack (screen reader): update dependencies</li><li>TalkBack (screen reader): remove more unused resources</li><li>TalkBack (screen reader): drop 32-bit OS support</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070900">2024070900</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070900-redfin">2024070900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070900">2024070900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070201 release:</p><ul><li>Settings: extend standard fingerprint enrollment stages with proper support for devices with power button fingerprint scanners (Pixel Fold, Pixel Tablet) which is not present in AOSP (Pixel Fold was still usable, but it had become incredibly hard to successfully register new fingerprints on the Pixel Tablet)</li><li>improve warning for 32-bit-only apps by explaining why the warning is shown, how to resolve it for apps that are still developed and that we plan to phase out support for it on 5th/6th generation Pixels where it's still available</li><li>show warning for 32-bit-only apps on each launch instead of only once</li><li>kernel (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a): disable 32-bit ABI support to substantially decrease kernel size and attack surface and raise mmap_min_addr to the standard 65536 for 64-bit-only ARM</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.158</li><li>adevtool: update file removal for 8th gen Pixels to skip Family Space related files</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-122">version 122</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.3">version 126.0.6478.122.3</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070201">2024070201</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070201">2024070201</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070200 release:</p><ul><li>full 2024-07-05 security patch level</li><li>rebased onto AP2A.240705.005 Android Open Source Project release</li><li>avoid skipping toggling USB port after unlock in certain edge cases to make sure devices connected while locked are always detected when unlocking</li><li>fix upstream bug causing first party app stores using the package install dialog to be blocked when the user isn't allowed to install apps from third party sources</li><li>fix notification suppression check in currently unused code to prepare for our per-app clipboard toggle</li><li>adevtool: download and use latest Pixel carrier settings from the API for use by our CarrierConfig2 app instead of using the snapshot included in the latest Pixel stock OS release since it lags months behind</li><li>Settings: fully fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy</li><li>Sandboxed Google Play compatibility layer: stub out reads of hidden system settings in Google's speech services app to avoid uncaught security exceptions</li><li>Sandboxed Google Play compatibility layer: don't allow the Play Store to abort pending package installation to avoid it cancelling install/update attempts after 10 minutes of waiting for requested user approval it hasn't been designed to handle</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.218</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.155</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.36</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070200">2024070200</a></h3><p>This is an early July security update release based on the July 2024 security patch backports. This month's release of the Android Open Source Project and stock Pixel OS will be available later today and we'll quickly release an update based on it following this one.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070200">2024070200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024062700 release:</p><ul><li>full 2024-07-01 security patch level</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.1">version 126.0.6478.122.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.2">version 126.0.6478.122.2</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/3">version 3</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-121">version 121</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024062700">2024062700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024062700">2024062700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024062000 release:</p><ul><li>add new GrapheneOS Info app through which you can get information about the latest releases of GrapheneOS, links to our community spaces, and details on how to make donations</li><li>Pixel 8a: add Let's Encrypt roots to Samsung gnssd CA root store for supl.grapheneos.org</li><li>Pixel 8a: configure Samsung gnssd to use TLSv1.2 for SUPL instead of TLSv1.1 (TLSv1.3 would work but the config doesn't offer it)</li><li>Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold: fully remove 32-bit ARM support to significantly reduce build time and update download size with no loss of functionality (7th gen Pixels launched with 32-bit app support disabled after several years of the Play Store blocking uploading 32-bit-only apps or installing them on 64-bit devices, and 8th gen Pixels use 2nd gen ARMv9 cores with no 32-bit support)</li><li>Settings: fix several cases of UI state being lost when resuming activity after configuration changes, etc. for GrapheneOS settings</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.216</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.90</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.35</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.0">version 126.0.6478.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-120">version 120</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024062000">2024062000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024062000">2024062000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061400 release:</p><ul><li>remove our USB peripheral security setting on devices supporting our much better USB-C port mode (Pixel 6 and later)</li><li>extend USB-C port setting to also handle pogo pins on the Pixel Tablet</li><li>kernel (5.10, 5.15, 6.1, 6.6): replace our deny_new_usb feature with a new deny_new_usb2 feature also disabling USB gadgets</li><li>extend USB-C port setting to enable deny_new_usb2 as a second layer of defense disabling new USB connections in the kernel (the existing implementation disables new connections and USB data at a hardware level via the USB controller, which disables more attack surface, but we want to keep around the higher level kernel approach too)</li><li>Files: fix upstream null pointer exception triggered on resuming activity</li><li>Settings: require user authentication for changing auto-reboot, USB peripheral and USB-C port security settings</li><li>Settings: avoid prompting for user authentication when selecting the same value as before for GrapheneOS settings requiring it</li><li>temporarily add back memory tagging exception for Pixel wifi_ext service</li><li>simplify implementation of our auto-reboot feature and properly handle the first lock after the user first sets up a lock method</li><li>avoid resetting USB-C port after first unlock if it was already connected Before First Unlock (fix for regression caused by upstream changes)</li><li>add GrapheneOS Linux kernel port to the 6.6 GKI LTS branch</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.215</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.87</li><li>kernel (6.1, 6.6): add script for building emulator kernel</li><li>kernel (6.1, 6.6): enable forced module signing for x86_64 (emulator builds)</li><li>System Updater: increase update check interval to 6 hours from 4 hours</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.110.0">version 126.0.6478.110.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-118">version 118</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-119">version 119</a></li><li>fix cast in GrapheneOS package management infrastructure needed for upcoming App Communication Scopes work</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061400">2024061400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061400">2024061400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061300 release:</p><ul><li>revert upstream refactoring of the device association code in Android 14 QPR3 due to it introducing a chain crash bug at boot in edge cases with associated devices such as paired Android Wear devices</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.71.0">version 126.0.6478.71.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061300">2024061300</a></h3><p>We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha and Beta testing.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061300">2024061300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061200 release:</p><ul><li>fix upstream Android 14 QPR3 regression which breaks updating certain apps with our app repository client</li><li>fix boot-time optimizing apps progress UI with Android 14 QPR3 and enable it again</li><li>fix regression in our Android 14 QPR3 port resulting in PIN scrambling in secondary users being determined by the Owner user setting</li><li>revert upstream Android 14 QPR3 Internet quick tile overhaul since it broke the functionality in secondary users</li><li>temporarily add back disabling memory tagging and hardened_malloc for surfaceflinger since Android 14 QPR3 didn't fix it as expected</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release</li><li>add additional null check for eSIM wiping done as part of the duress PIN/password wipe implementation to avoid harmless exception</li><li>Settings: remove blank illustration from "Screen resolution" screen</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.1">version 126.0.6478.50.1</a></li><li>make duress PIN/password tests faster and more reliable</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061200">2024061200</a></h3><p>This is the first release of GrapheneOS based on Android 14 QPR3, the 3rd quarterly maintenance/feature release for Android 14.</p><p>We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha testing.</p><p>Pixel 8a is now supported as part of the standard Android releases instead of having a device branch based on Android 14 QPR1. We've had stable releases for it available since May 15th (1 day after launch) based on our last QPR1-based release (2024030300). Pixel 8a users will be getting the GrapheneOS improvements from March, April, May and June along with the Android 14 QPR2 and QPR3 improvements so it's a much larger release for the Pixel 8a.</p><p>Since Android 14 QPR3 is a major release, the end-of-life Pixel 4a (5G) and Pixel 5 receiving extended support releases from GrapheneOS will need to be ported to it with additional work in a future release, which is done as a low priority. Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061200">2024061200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024060500 release:</p><ul><li>full 2024-06-05 security patch level</li><li>rebased onto AP2A.240605.024 Android Open Source Project release, which is the 3rd quarterly maintenance/feature release for Android 14 (QPR3)</li><li>temporarily disable boot-time optimizing apps progress UI due to upstream Android 14 QPR3 regression (our own post-boot background optimizing apps progress notification works fine)</li><li>temporarily enable system crash notifications unconditionally for the initial QPR3-based release</li><li>change default USB-C port mode to "Charging-only when locked" from "Charging-only when locked, except before first unlock"</li><li>stop disabling memory tagging and hardened_malloc for surfaceflinger</li><li>Settings: fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.0">version 126.0.6478.50.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-117">version 117</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024060500">2024060500</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060500-redfin">2024060500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060500">2024060500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024060400 release:</p><ul><li>Sandboxed Google Play compatibility layer: adjust to DynamiteLoader changes being deployed with a new feature flag in Play services 24.22</li><li>stop treating pressing the spacebar on a physical keyboard as submitting the lockscreen password since it prevents entering passphrases with spaces (upstream Android bug which has existed for around 8.5 years)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.165.0">version 125.0.6422.165.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-116">version 116</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024060400">2024060400</a></h3><p>This is an early June security update release based on the June 2024 security patch backports since this month's release of the Android Open Source Project and stock Pixel OS with Android 14 QPR3 isn't available yet.</p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060400-redfin">2024060400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060400">2024060400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024053100 release:</p><ul><li>full 2024-06-01 security patch level</li><li>extend the standard wipe-without-reboot implementation beyond wiping the hardware keystores (which prevents recovering any OS data by preventing deriving the key encryption keys) by also wiping the secdiscardable data on the SSD needed to derive key encryption keys, the encrypted storage keys on the SSD and the Weaver slots in the secure element needed to derive per-user key encryption keys via a secure element erase</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>ke</li></ul></article></section>https://grapheneos.org/releases#2024060400<section id="changelog" morss_own_score="6.559377178712526" morss_score="581.9633262681497"><h2><a href="https://grapheneos.org/releases#changelog">Changelog</a></h2><p>List of tagged releases. Snapshot releases without tags such as early releases of the project and early device support releases are not listed.</p><p>The changelog is also available as an <a href="https://grapheneos.org/releases.atom">atom feed</a> usable in any standard feed reader.</p><p>The <a href="https://grapheneos.org/history/legacy-changelog">legacy changelog page</a> has the release notes from before the rebranding of the project in 2018 and 2019.</p><article><h3><a href="https://grapheneos.org/releases#2026110100">2026110100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026110100">2026110100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026102100 release:</p><ul><li>add working support for satellite-based cellular service avoiding the previous issues which caused Android Auto to be partially broken due to malfunctioning APIs (confirmed to work with the T-Satellite service from T-Mobile)</li><li>disable buggy defer_service_restart_when_frozen flag due to it breaking handling of service restarts for frozen service clients</li><li>run previously missed post-spawning cleanup for secure (exec) spawning with the native zygote to avoid leaving signals blocked (in practice, this is only used by a subset of Chromium-based browsers including Vanadium to spawn sandboxed renderers as more lightweight native processes and will also be used for the WebView soon)</li><li>SystemUI: fix an upstream Android use-after-free bug in PipTouchHandler</li><li>add fix for remote denial of service vulnerability from the November 2026 security bulletin to the regular releases which has been fixed in our security preview releases since July 2026</li><li>Sandboxed Google Play compatibility layer: fix an IThirdPartyPayService GmsCore crash</li><li>Launcher: fix upstream bug breaking home screen accessibility actions</li><li>kernel (6.18): fix compatibility issues between slab canaries and sheaf allocation added in 6.18</li><li>kernel (6.18): re-enable AutoFDO function splitting optimization since both clang and rustc include the necessary LLVM bug fix for it which was missing for the Android 6.12 kernel toolchain</li><li>kernel (6.18): use the Rust implementation of Binder instead of the legacy C implementation</li><li>kernel (6.18): switch lockdown for the main Android kernel to integrity mode since DMA-BUF statistics now use a BPF program incompatible with confidentiality mode instead of the now deprecated sysfs interface compatible with it (microdroid kernel still uses confidentiality mode)</li><li>kernel (6.18): selinux: add initialized check to security_sid_to_context_type_core to guard against a theoretical issue</li><li>kernel (6.18): fix upstream block-layer races causing kernel crashes and incorrect I/O statistics</li><li>kernel (6.18): fix upstream pKVM IOMMU allocation and retry handling bugs, including a hang during recovery sideloading</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): port all the drivers to the 6.18 kernel branch and switch to it</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream bug breaking recovery from cellular radio boot failures</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream pKVM/SMMU bugs in DMA mapping, error handling and timeout detection</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream memory lifetime bugs in interconnect, CPM tracing and subsystem crash dump drivers</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream initialization, cleanup and error handling bugs in USB charging, display, touch, input, TPU and SoC information drivers</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream callback lifetime bugs in UFS, battery monitoring and modem drivers during initialization failure and cleanup</li><li>kernel (Pixel): stop building with LTO since kCFI doesn't require it, the Pixel OS stopped using it and it's incompatible with newer kernel branches due to Rust + BTF + LTO not being supported together</li><li>kernel (6.1, 6.6, 6.12, 6.18): fix handling edge cases for GrapheneOS SELinux extension auditing code</li><li>kernel (6.1, 6.6, 6.12, 6.18): backport patch for CVE-2026-98432 (MPTCP was already disabled in all of the kernels along with having defenses including MTE)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.182</li><li>kernel (6.1): backport 6 patches from later LTS releases to fix regressions caused by the currently included LTS patches</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.97</li><li>kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.38</li><li>kernel (generic): enable stamping build with Git commit metadata as is already done for Pixel and microdroid kernel builds</li><li>add explicit preloading of Build.VERSION in the zygote process as a replacement for the SELinux policy change in the <a href="https://grapheneos.org/releases#2026102100">previous release</a> fixing Cuttlefish</li><li>revert marking CredentialSelectorActivity opaque as an added GrapheneOS security protection due to app compatibility issues</li><li>Sandboxed Google Play compatibility layer: revert marking FIDO activities as opaque as an added GrapheneOS security protection due to app compatibility issues</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/37">version 37</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/17">version 17</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/18">version 18</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/156.0.8078.73.0">version 156.0.8078.73.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/156.0.8078.79.0">version 156.0.8078.79.0</a></li><li>TalkBack: update to <a href="https://github.com/GrapheneOS/TalkBack/releases/tag/23">version 23</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-178">version 178</a></li><li>Thread network: grant network access to the HAL and simulated Radio Co-Processor (RCP) used for testing in Cuttlefish to avoid breaking the tests</li><li>adevtool: process-kernel-tarballs: add support for tarball-per-target format</li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026110101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-49921, CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0197, CVE-2027-0199</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026102100">2026102100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026102100">2026102100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026101600 release:</p><ul><li>Sandboxed Google Play: fix handling of foreground service types to fix certain services crashing with new versions of Play services and Play Store</li><li>Sandboxed Google Play: add missing declaration of gmscompat process to fix installing Google Search App</li><li>remove the active eMudhra ECDSA root certificate due to compromised intermediate certificates (Vanadium received the removal of this root certificate as an out-of-band component update via our servers when it was released for Chrome)</li><li>remove both legacy eMudhra root certificates (this leaves the heavily used active RSA root certificate as the only remaining one and we're considering either removing it or disabling it by default despite other platforms not removing it at this time)</li><li>add built-in app hibernation exemption for Auditor since it removes the scheduled job for remote attestation after 90 days of not opening the app and results in alerts until users open the app again</li><li>add explicit app hibernation exemptions for App Store and System Updater instead of relying on the implicit exemptions received by a system package manager (App Store) and system apps without a launcher activity (System Updater)</li><li>hardened_malloc: eliminate unused space in quarantine arrays to reduce memory usage</li><li>revert hardening for apps with lockscreen activities added in our <a href="https://grapheneos.org/releases#2026101600">previous release</a> due to compatibility issues</li><li>boot animation: add 0.8s interruptible hold for the logo for a total of 1.6s</li><li>boot animation: reduce logo size for Pixel Tablet to 30% of the shorter dimension from 40%</li><li>boot animation: replace the last use of smoothstep for easing into the loop with smootherstep</li><li>adevtool: backport Android 17 QPR2 Beta 7.1 mmap readahead configuration as a replacement for our kernel change removing it</li><li>kernel (Pixel): undo mmap readahead change replaced by a userspace change disabling both features</li><li>kernel (6.1, 6.6, 6.12, 6.18): backport additional upstream security patches not yet included in the GKI LTS branches</li><li>kernel (6.12, 6.18): update to latest GKI LTS branch revision</li><li>kernel (6.12, 6.18): fix mishandling of ramoops parameter with lockdown mode</li><li>kernel (6.12, 6.18): fix compatibility of slab canaries with KASAN for Cuttlefish</li><li>kernel (6.18): add back linear map randomization downstream with it depending on memory hotplug being disabled at build time which is the case for GrapheneOS kernels since it's an unused feature</li><li>kernel (6.18): microdroid: disable unused memory hotplug</li><li>switch microdroid from Linux 6.6 to Linux 6.18 by default</li><li>switch emulator builds from Linux 6.12 to Linux 6.18 by default and only provide 6.18 prebuilts</li><li>switch emulator builds to using the the standard generic kernel prebuilts used by Cuttlefish instead of dedicated emulator builds since it's exactly the same set of files for GrapheneOS</li><li>switch Cuttlefish builds from Linux 6.12 to Linux 6.18 by default and only provide 6.18 prebuilts</li><li>add missing GrapheneOS components to generic builds used for Cuttlefish targets</li><li>SELinux policy: add missing property labels for Cuttlefish</li><li>scale hardening test timeouts based on hardware timeout multiplier to avoid timeouts for slow targets such as arm64 Cuttlefish relying on instruction emulation</li><li>prefer host rendering for Cuttlefish to work around JIT compilation being blocked on GrapheneOS</li><li>mesa: fix deadlock for gfxstream with Cuttlefish using host rendering</li><li>fix Cuttlefish host rendering on headless hosts without a physical GPU for the system Vulkan driver</li><li>fix Cuttlefish boot without Bluetooth being enabled by default</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/156.0.8078.47.0">version 156.0.8078.47.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-177">version 177</a></li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026102101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026101600">2026101600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026101600">2026101600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026100600 release:</p><ul><li>Sandboxed Google Play: switch from RpcProvider to service bindings and broadcasts to handle new versions of Play services</li><li>Sandboxed Google Play: improve handling of Play Store install confirmation dialogs</li><li>Launcher: update configurations and resources to match Pixel Launcher</li><li>expand Sensors permission to custom sensor types added by devices which includes temperature, pressure and proximity sensors for Pixels in practice</li><li>WindowManagerService: fix upstream Android vulnerability from PID and UID parameter mixup</li><li>Settings: show adaptive connectivity setting for controlling the default enabled connectivity heuristics</li><li>prevent resuming activities hidden by the lockscreen after an activity finishes to resolve an upstream security weakness</li><li>adevtool: fix NFC/eSE/eSIM firmware updates on 9th generation Pixels (this issue started with the October 2026 update and earlier firmware versions applied fine without this)</li><li>add back disabling of preloading graphics driver for secure (exec) spawning</li><li>new GrapheneOS boot animation</li><li>enable multi-display boot animation feature to display it on the outer display of folding devices too</li><li>fix upstream bug resulting in the boot animation on the outer display of folding devices stalling due to display configuration in the late boot process (this is likely why AOSP and the stock Pixel OS still don't display a boot animation on the outer display)</li><li>Pixels: update to October 2026 kernel drivers which was delayed due to ongoing lack of GPLv2 compliance by Google (none of the security patches listed in the October 2026 Pixel Update Bulletin are in the kernel drivers for 6th through 10th gen Pixels)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.96</li><li>kernel (6.18): update to latest GKI LTS branch revision</li><li>update timezone data to 2026e</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/155.0.8059.39.0">version 155.0.8059.39.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/155.0.8059.79.0">version 155.0.8059.79.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/155.0.8059.84.0">version 155.0.8059.84.0</a></li><li>TalkBack: switch to standalone app signing key</li><li>fix benign CtsWindowManagerDeviceKeyguard:KeyguardLockedTests test failures caused by the 2nd factor PIN entry being focusable during creation of the user interface</li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026101600 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59069</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026100600">2026100600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026100600">2026100600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026100200 release:</p><ul><li>full 2026-10-05 security patch level</li><li>Pixels: update to October 2026 firmware and HALs</li><li>fix upstream integer overflow bug in ZipFileRO.cpp causing memory corruption with a 65,535 byte entry name</li><li>use speed compiler filter for all system_server JARs and non-APEX APKs instead of using speed-profile when a profile exists (improves core OS performance)</li><li>Contacts: don't offer local accounts for new labels when default account is cloud</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.94</li><li>kernel (6.18): update to latest GKI LTS branch revision</li><li>kernel (6.6, 6.12, 6.18): change approach to disabling Android's vendor hooks for INIT_ON_FREE to avoid conflicts</li><li>Seedvault: migrate to the latest upstream Android 17 branch from our own port to Android 17 to get the latest upstream improvements</li><li>Seedvault: implement downstream fixes for a bunch of bugs and user interface deficiencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.126.0">version 154.0.8037.126.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-176">version 176</a></li></ul><p>All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026100601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59066, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026100200">2026100200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026100200">2026100200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026092500 release:</p><ul><li>kernel (Pixel): restore Android 17 (CP2A) mmap read-ahead behavior to resolve stuttering due to memory pressure caused by an upstream Pixel kernel change in Android 17 QPR1</li><li>disable unprivileged hardware keepalives since it creates a VPN leak</li><li>raise listed security patch level to 2026-09-05 since we've already had the 2026-09-05 Android security patch level for a while and have all the Pixel firmware/driver updates from Android 17 QPR1 since the last release</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.144</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.33</li><li>fix upstream Android bug causing last modified time being set incorrectly for files restored from Android backups due to it passing seconds to an API taking milliseconds (files had last modified time set to January 1970)</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/13">version 13</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/14">version 14</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/15">version 15</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/16">version 16</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.92.0">version 154.0.8037.92.0</a></li><li>adevtool: add command for processing Pixel kernel tarballs</li><li>arcslib: add support for system_ext overlays</li><li>apksig: handle APKs that lack a V3 signature in print-certs command</li><li>add ColdFileReadBenchmark to benchmark cold mmap reads with low free swap</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026100201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58820, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59059, CVE-2026-59063</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026092500">2026092500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026092500">2026092500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026091900 release:</p><ul><li>Pixels: fully update kernel drivers, firmware and userspace hardware support code to Android 17 QPR1 by adding infrastructure to support it on Android 17</li><li>add back SIM PIN scrambling toggle in the new Protect SIM card screen</li><li>Settings: improve user interface for the secure paste feature controlling clipboard access</li><li>adevtool: restore the Cape modem carrier override for 6th generation Pixels since Google didn't include it</li><li>adevtool: reclaim storage space reserved for preloaded AI models used by the stock Pixel OS on 10th/11th gen Pixels</li><li>bionic libc: add missing stack size calculation overflow check (no real world impact)</li><li>bionic libc: revert legacy change removing VLA due to -fstack-clash-protection making it safe for a while now (fixes an issue with Bionic trace markers)</li><li>Sandboxed Google Play: add CLOEXEC to zip file descriptors created with dup for sandboxed Google Play services dynamite modules in ART, bionic and libcore (no real world impact)</li><li>hardened_malloc: optimize slab quarantine indexing by limiting slab quarantine length multipliers to a power of two (both multipliers are set to the default of 1)</li><li>hardened_malloc: optimize aligned size class calculation</li><li>hardened_malloc: optimize size class struct layout</li><li>hardened_malloc: add missing "cc" to clobber list for MTE assembly (bug inherited from LLVM with no real world impact)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-175">version 175</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.57.0">version 154.0.8037.57.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/154.0.8037.57.1">version 154.0.8037.57.1</a></li><li>add scripts for automating building kernels and updating the builds included in the OS source tree</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026092501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026091900">2026091900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026091900">2026091900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026091700 release:</p><ul><li>Pixels: backport CarrierSettings from Android 17 QPR1 to resolve carrier compatibility issues caused by the modem firmware backport</li><li>Pixels: backport wfc-pkt-router from Android 17 QPR1 to resolve a crash</li><li>reduce rate limit for notifying about clipboard reads blocked by our secure paste feature from 1 minute to 6 seconds since users can toggle off the notice on a per-app basis if it's an annoyance</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.52.0">version 153.0.8010.52.0</a></li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054</li><li>Unclassified: CVE-2026-58994</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026091700">2026091700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026091700">2026091700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026091000 release:</p><ul><li>Pixels: backport cellular modem firmware from Android 17 QPR1</li><li>add per-app toggle for disallowing apps reading the clipboard with a global toggle to make it the default (forces pasting via the OS selection toolbar, keyboard apps, keyboard shortcuts or accessibility services)</li><li>Keyboard: add paste chip to offer pasting recently copied content when there's nothing else to show as an option</li><li>Dialer: default to the contact opt-out mode for users enabling automatic call recording for the first time rather than opt-in</li><li>update timezone data to 2026c</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.177</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.143</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.93</li><li>add 6.18 kernel branch</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.47.0">version 153.0.8010.47.0</a></li><li>adevtool: improve the process-bulletin-patches command</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054</li><li>Unclassified: CVE-2026-58994</li></ul><p>Other changes in the 2026091701 security preview release:</p><ul><li>fix upstream bug breaking sending MMS from secondary users</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026091000">2026091000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026091000">2026091000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026090700 release:</p><ul><li>full 2026-09-01 security patch level</li><li>Contact Scopes: improve compatibility with certain apps</li><li>Dialer: add the option to enable call recording for every contact by default with a list of excluded numbers</li><li>Dialer: declare microphone and phone foreground service type to fix automatic call recording for answering calls via Bluetooth</li><li>SystemUI: respect lockscreen media setting on always-on display</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-174">version 174</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/153.0.8010.36.0">version 153.0.8010.36.0</a></li><li>adevtool: improve the apply-bulletin-patches command and rename it to process-bulletin-patches</li></ul><p>All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091001 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032</li><li>Unclassified: CVE-2026-58994</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026090700">2026090700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026090700">2026090700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026090500 release:</p><ul><li>dismiss app drawer keyboard before private space unlock to fix private space search credential prompt text disappearing on secondary users</li><li>hardened_malloc: update libdivide to 5.4.0</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55260, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55274, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59032</li><li>Unclassified: CVE-2026-58994</li></ul><p>Other changes in the 2026090701 security preview release:</p><ul><li>fix security preview patch breaking the volume bar button for displaying the rest of the volume controls</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026090500">2026090500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026090500">2026090500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026081300 release:</p><ul><li>Launcher: filter Private Space apps from search while it's locked to resolve upstream privacy deficiency (Pixel Launcher delegates search to Android System Intelligence which fixed this already)</li><li>Launcher: add "Private Space" action for unlocking the Private Space to app drawer search to match the Pixel Launcher</li><li>Launcher: fix upstream crash on large-screen devices when opening a folder from the taskbar with 3-button navigation</li><li>Settings: add warning about the standard Android feature for hiding Private Spaces only being superficial and having multiple known tricks for detecting it</li><li>Dialer: add support for automatic call recording with a per-call opt-out switch for both incoming and outgoing calls along with a notice of automatic call recording being active during calls</li><li>backport upstream Android 17 QPR1 Beta 5 fix for widgets disappearing after reboot</li><li>exempt DocumentsUI from redaction of location metadata to resolve upstream bug causing the system file manager to redact location metadata for copies or certain moves</li><li>Settings: initialize display color mode to the correct default value to resolve remaining issues with switching back to the default color mode for Pixels caused by an upstream bug not currently impacting the stock Pixel OS</li><li>adevtool: remove Saturated color options from devices where it isn't properly supported</li><li>Sandboxed Google Play compatibility layer: fix PackageInstaller.installPackageArchived() stub</li><li>hardened_malloc: replace MADV_DONTNEED with MADV_DONTNEED_LOCKED to improve compatibility with mlockall</li><li>hardened_malloc: enforce success for MADV_DONTNEED_LOCKED to avoid the need for a memory clearing fallback path</li><li>hardened_malloc: avoid unnecessary purging end guard for shrinking large allocations</li><li>hardened_malloc: replace MAP_FIXED and fix MREMAP_FIXED ENOMEM handling to fix extreme out-of-memory edge cases where these unmap the target but fail to replace it</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): update to latest upstream kernel driver sources (replaces our manual backport of CVE-2026-0163)</li><li>kernel (6.6, 6.12): add workaround for an upstream arm64 KVM bug breaking booting with lockdown in confidentiality mode (this was previously only applied for a variant of the 6.6 branch specific to 10th gen Pixels but is more broadly applicable)</li><li>kernel (6.6): fix edge case error handling for missing SELinux policy in our extensions to SELinux</li><li>kernel (6.12): AutoFDO: disable machine function splitting due to an incompatibility with BTI which is enabled by GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.42.0">version 152.0.7977.42.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.54.0">version 152.0.7977.54.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.64.0">version 152.0.7977.64.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/152.0.7977.84.0">version 152.0.7977.84.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-173">version 173</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/8">version 8</a></li><li>adevtool: add support for unpacking optimized GrapheneOS factory images</li><li>adevtool: add an option to use stock OS kernel files for testing purposes</li><li>adevtool: improve the apply-bulletin-patches command</li><li>Launcher: fix Launcher3QuickStepTests for Android 17</li><li>SELinux policy: remove workaround no longer required by our current secure spawning implementation</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55260, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55274, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59032</li><li>Unclassified: CVE-2026-58994</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026081300">2026081300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026081300">2026081300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026080500 release:</p><ul><li>Bluetooth: handle nested secondary profiles when sending broadcasts to fix support for wireless Android Auto in nested secondary profiles (Private Spaces and work profiles)</li><li>enable multiuser-unaware API usage warnings for Bluetooth processes</li><li>Contact Scopes: use identity of the calling app for the filtered query since the query validation, projection mapping, etc. depend on the target SDK version of the calling app (this is a proper solution to the Contact Scopes compatibility issues for WhatsApp and sandboxed Google Play services in Android 17 replacing our previous workaround)</li><li>CredentialManager: make CredentialSelectorActivity opaque (avoid showing activity underneath) to resolve security vulnerabilities not yet fixed upstream</li><li>Sandboxed Google Play compatibility layer: mark all Play services FIDO activities as opaque (avoid showing activity underneath) to resolve Play services security vulnerabilities not yet fixed upstream</li><li>Sandboxed Google Play compatibility layer: prevent the Play services from being frozen by the cached app freezer by binding to the persistent process from GmsCompat (this resolves Firebase Cloud Messaging delays)</li><li>Sandboxed Google Play compatibility layer: fix race conditions in GLocationService.flushLocations() and PersistentFgService.requestStart() to avoid crashes in edge cases</li><li>Sandboxed Google Play compatibility layer: add special handling for Android Auto OutOfCarLifecycle crashes to avoid getting issue reports for expected uncaught exceptions from Android Auto connectivity loss</li><li>Sandboxed Google Play compatibility layer: only notify about missing Notifications permission for Play services since other components such as the Play Store handle it themselves</li><li>Sandboxed Google Play compatibility layer: switch privSettingsPutStrings() to StringParceledListSlice to handle larger arrays</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.176</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.83.0">version 151.0.7922.83.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.108.0">version 151.0.7922.108.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.137.0">version 151.0.7922.137.0</a></li><li>adevtool: improve the apply-bulletin-patches command</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026081301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979</li><li>Unclassified: CVE-2026-55260, CVE-2026-58883</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026080500">2026080500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026080500">2026080500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026072900 release:</p><ul><li>full 2026-08-05 Pixel security patch level</li><li>update to August 2026 Pixel driver/firmware code</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): apply fix for CVE-2026-0163</li><li>Contact Scopes: add a workaround for WhatsApp ACCOUNT_TYPE queries to resolve an incompatibility introduced with Android 17</li><li>Sandboxed Google Play compatibility layer: retain RPC provider connection for out-of-memory adjustment</li><li>backport Android 17 QPR1 fix for Bluetooth developer options confirmation</li><li>kernel (6.1, 6.6, 6.12): backport patch for CVE-2026-64560</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.71.0">version 151.0.7922.71.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/91">version 91</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/92">version 92</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/93">version 93</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/33">version 33</a></li><li>adevtool: add command for removing unused device images</li><li>adevtool: improve the apply-bulletin-patches command</li></ul><p>All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026080501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58957, CVE-2026-58958</li><li>Unclassified: CVE-2026-55260, CVE-2026-58883, CVE-2026-58935</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026072900">2026072900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026072900">2026072900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026071500 release:</p><ul><li>extend per-app opt-out for hardened_malloc and extended virtual address space to child processes to support working around rare app compatibility issues involving separate native processes run by an app</li><li>override previous SELinux context for secure (exec) spawning to fix compatibility with anti-tampering libraries checking for it</li><li>ContactsProvider: fix upstream Android security vulnerability</li><li>Telephony: fix upstream Android security vulnerability caused by missing system permission check for apps with API levels below 30</li><li>adevtool: include feature flags for Pixel NFC/eSE/eSIM firmware updater to avoid deviating from the stock OS</li><li>work around upstream bug for original-package renaming to resolve crashes with Vanadium on OS installs from 4-5 years ago when using the native zygote (we had to temporarily turn off javaless renderers in Vanadium Config 192 and will re-enable it after this OS release)</li><li>libpng: backport upstream security patches</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.175</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.142</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.92</li><li>improve GrapheneOS package state infrastructure to fix minor rare non-serious bugs</li><li>replace our workarounds for pseudo-locale crashes with a proper fix for the issue</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.29.0">version 151.0.7922.29.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/151.0.7922.47.0">version 151.0.7922.47.0</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/7">version 7</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-172">version 172</a></li><li>add a way to use any WebView provider on OS debug builds</li><li>fix pointer aliasing in malloc dispatch tables to fix malloc debug functionality in certain cases</li></ul><p>All of the Android 17 security patches from the current August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026072901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58868, CVE-2026-58869, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260, CVE-2026-58820, CVE-2026-58883, CVE-2026-58935</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026071500">2026071500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026071500">2026071500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026071100 release:</p><ul><li>Secure (exec) spawning: skip vkey.android.vos.VosZygotePreload to make exec-based spawning compatible with apps using V-KEY V-OS Mobile App Protection</li><li>Secure (exec) spawning: skip redundant mount namespace setup for compatibility with anti-tampering code checking Linux mount IDs</li><li>start compat zygote at boot instead of on-demand for compatibility with anti-tampering code checking Linux mount IDs (compat zygote is only used when both secure spawning and hardened_malloc are disabled for an app)</li><li>use lazy preloading for compat zygote to reduce memory usage when it's not used (it's only used for app processes which disable both hardened_malloc and secure spawning)</li><li>install CarrierConfig2 in all profiles to avoid using default carrier configuration values in secondary users</li><li>notify when Wi-Fi hotspot is disabled due to user change (since users have separate Wi-Fi settings since Android 17) to provide a shortcut for turning it back on via the notification</li><li>remove our change raising the zygote's maximum file limit to 256Ki since this has been implemented upstream as a 512Ki limit with correct handling for 32-bit processes</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): integrate minor upstream synopsys driver change unrelated to security</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.141</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.124.0">version 150.0.7871.124.0</a></li><li>add secure spawning file descriptor regression test</li></ul><p>All of the Android 17 security patches from the current August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026071501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58868, CVE-2026-58869</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260, CVE-2026-58820</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026071100">2026071100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026071100">2026071100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026070500 release:</p><ul><li>replace secure (exec) spawning feature with a new implementation with improved app compatibility and a per-app toggle replacing the previous global toggle</li><li>extend exec spawning feature to the native zygote added in Android 17</li><li>raise listed security patch level to 2026-07-05 security patch level which has no additional patches listed in either the Android or Pixel bulletin</li><li>update to July 2026 Pixel driver/firmware code</li><li>fix upstream bug in multi-user handling for the WifiService package state listener which among other possible issues was causing wireless Android Auto compatibility issues in secondary users</li><li>fix upstream bug in RemoteException handling for GeocodeProviderBase causing exceptions between the geocoding service and client app to crash the geocoding service</li><li>fix external display mirroring in secondary users (upstream bug)</li><li>fix handling of multiple users for screen recording (upstream bug)</li><li>Sandboxed Google Play compatibility layer: add MODIFY_PHONE_STATE to the special Android Auto phone call permissions toggle since it's needed for managing phone calls in recent versions</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.140</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.90</li><li>bionic libc: fix API level check for %#m format string (upstream bug)</li><li>update_device.py: improve the experience of testing updates on debug builds by avoiding restarting ADB as root</li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/32">version 32</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.114.0">version 150.0.7871.114.0</a></li></ul><p>All of the Android 17 security patches from the current August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026071101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49933</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55258, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026070500">2026070500</a></h3><p>Users solely doing offline updates via recovery mode sideloading need a <a href="https://discuss.grapheneos.org/d/37947-special-sideload-only-android-16-qpr2-release-fixing-sideloading-to-android-17">special sideload-only release</a> to update from Android 16 QPR2 to Android 17. This release fixes upstream bugs for sideloading present in Android 16 QPR2 which prevented updating to Android 17 unless the OS images were far larger than the GrapheneOS ones which triggers a fallback path avoiding the issue.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026070500">2026070500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062800 release:</p><ul><li>rebuild coarse locations from allowlisted fields to resolve an upstream Android privacy flaw leaking secondary fields such as altitude and accuracy to apps without precise location granted</li><li>System UI:: run scroll capture tile handling on main thread to fix an upstream race condition causing memory corruption</li><li>Launcher: fix removing space for the quick search bar to avoid removing padding at the bottom</li><li>fix PIN scrambling for Private Spaces configured to use parent credentials</li><li>implement enhanced PIN privacy for the new PIN pad used outside of the lockscreen</li><li>fix handling of TEXT_SHOW_PASSWORD to split TEXT_SHOW_PASSWORD_TOUCH TEXT_SHOW_PASSWORD_PHYSICAL in Android 17</li><li>backport security patches for FreeType</li><li>kernel (6.1, 6.6, 6.12): fix upstream double-free bug in USB gadget Ethernet driver which was caught by hardware memory tagging in GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.1, 6.6, 6.12): backport fixes for CVE-2026-46242</li><li>enable precompiling dex bytecode for Vanadium now that the Trichrome Library APK no longer breaks compatibility with it (shared library APKs are incompatible with precompilation and this is the only one in the OS)</li><li>Theme Picker: replace references to apps not included in GrapheneOS to avoid black icons</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.63.0">version 150.0.7871.63.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/150.0.7871.63.1">version 150.0.7871.63.1</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026070501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49933</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55258, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263</li><li>Unclassified: CVE-2026-28653, CVE-2026-55260</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062800">2026062800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062800">2026062800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062300 release:</p><ul><li>add setting for controlling Certificate Transparency (CT) log list downloads used for apps enforcing CT which is enabled by default for apps targeting Android 17+ with a choice between GrapheneOS (default), Standard (previous behavior) and Off</li><li>enable register_bluetooth_receiver_for_all_users feature flag to fix Bluetooth telecom functionality in secondary users (resolves an upstream regression in Android 17)</li><li>temporarily use absolute media profile XML paths to work around an exec-based spawning compatibility issue breaking WhatsApp functionality which will be properly addressed by our upcoming overhaul to exec-based spawning</li><li>add native zygote support to handle Chrome using it and for future use in Vanadium once exec spawning is ported to it</li><li>build wpa_supplicant_mainline from source since it's used instead of the vendor wpa_supplicant on the Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold</li><li>fix NFC quick tile state not updating in secondary users</li><li>Settings: fix lifecycle of the added NFC state listener to avoid crashes for the Connection preferences page in edge cases</li><li>Settings: fix minor regression losing listing the duress password feature as being one of the settings available in the screen lock menu which helps people discover the feature</li><li>Sandboxed Google Play compatibility layer: add stub for PackageInstaller.installPackageArchived()</li><li>Sandboxed Google Play compatibility layer: use fresh file proxy file descriptors for app opens to fix compatibility issues</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix another upstream out-of-bounds array read caught by hardware memory tagging in the DisplayPort driver caused by devices implementing the DisplayPort protocol incorrectly and the kernel driver not properly handling the incorrect data</li><li>don't report harmless ExynosDevice::dynamicRecompositionThreadLoop crash</li><li>Seedvault: grant local network access to fix local network usage for backups with Android 17</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.197.0">version 149.0.7827.197.0</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/7">version 7</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49921</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49924</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062300">2026062300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062300">2026062300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062200 release:</p><ul><li>fix serious upstream Android VPN race condition resulting in the always-on VPN being disabled in edge cases including VPN app updates</li><li>fix Bluetooth auto-off in secondary users for Android 17</li><li>Sandboxed Google Play compatibility layer: resolve ThermalManagerService droidguard incompatibility causing RCS to break after droidguard is updated</li><li>Sandboxed Google Play compatibility layer: increase log level of maybeInterceptBinderProxyDump() to help with debugging droidguard checks</li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062200">2026062200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062200">2026062200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026062100 release:</p><ul><li>change the behavior of pressing the new Android 17 Wi-Fi quick tile to disabling Wi-Fi instead of only pausing it by disconnecting from the current network and not actively connecting to another automatically</li><li>backport upstream fix for recovery mode sideloading to replace the workaround we included in our initial public Android 17 release (this will needed to be backported to Android 16 QPR2 to provide a sideload upgrade path)</li><li>Sandboxed Google Play compatibility layer: add local network access to the permissions added by the wireless Android Auto toggle since it's often required</li><li>Sandboxed Google Play compatibility layer: add stub for NsdManager.registerService() to handle lack of ACCESS_LOCAL_NETWORK</li><li>enable photopicker in Wallpaper Picker app to restore photo picker functionality from before Android 17</li><li>Wallpaper Picker: add vertical padding to the "Choose a photo" button</li><li>Launcher: fix hidden workspace app labels on non-responsive grids</li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026062100">2026062100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026062100">2026062100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026061800 release:</p><ul><li>disable MTE for Widevine Rikers service since it's incompatible with it (issue predates Android 17)</li><li>Sandboxed Google Play compatibility layer: avoid opening extra file descriptions to obtain Play services data prefix paths to avoid a compatibility issue with anti-tampering code used by the Kia Connect app and likely others (issue predates Android 17)</li><li>separate GrapheneOS framework resource IDs from AOSP resource IDs to avoid incompatibilities with Pixel vendor components (issue predates Android 17)</li><li>kernel (Pixel 10): fix for an upstream Broadcom Wi-Fi bcm4383 driver memory corruption bug to avoid invalid memory accesses caught by the kernel hardware memory tagging enabled by GrapheneOS</li><li>disable UBLK feature flag for over-the-air updates due to it likely causing update reliability issues for devices with support for it (6.6 kernel or newer)</li><li>disable UBLK for generated over-the-air update packages to force disable it for updates from the initial Android 17 release</li><li>increase the maximum size of log events in production builds to match debug builds to avoid the kernel panic message and traceback being cut off</li><li>use DevicePolicyManager.MAX_PASSWORD_LENGTH PIN length limit for the new upstream SystemUI PIN user interface for entering the PIN outside of the lockscreen to fix support for the expanded limit of 128 on GrapheneOS instead of using Android's limit of 16 (this didn't apply to passwords and it was straightforward to work around it by changing the PIN to a password)</li><li>Settings: show night light settings even when Pixel Comfort View is enabled since we're missing the settings for it (currently only relevant to the 10th gen Pixels other than the Pixel 10a)</li><li>allow using the new flashlight quick tile while locked (GrapheneOS requires unlocking by default for system quick tiles)</li><li>SystemUI: avoid crashing when trying to edit a screen recording without a video editor app</li><li>fix upstream bug causing the security scan in the Settings app to take much longer in Android 17 (also impacts the stock OS)</li><li>fix compatibility issue breaking resetting permissions for apps with special-runtime permissions (Nearby Devices is now split to have Local Network access enabled by default for compatibility for apps not targeting Android 17 and there are bugs with how this is handled)</li><li>Launcher: remove quick search bar from showing on large display devices since Android 17</li><li>Launcher: remove space reserved for the quick search bar since Android 17</li><li>add Pixel Comfort View settings for supported devices (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold)</li><li>add back error message for entering an incorrect 2nd factor PIN for the GrapheneOS 2-factor fingerprint unlock feature</li><li>fix compatibility with the native zygote spawning system added by Android 17 which isn't enabled yet (this was added to provide more lightweight sandboxed renderer processes for Chromium and will benefit Vanadium even more due to having finer-grained process isolation but isn't used by Chromium/Chrome yet and our secure spawning will need to be ported to it)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-171">version 171</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026061800">2026061800</a></h3><p>This is the initial release of GrapheneOS based on Android 17.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026061800">2026061800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026061600 release:</p><ul><li>full 2026-06-05 Pixel security patch level (released with Android 17)</li><li>rebased onto CP2A.260605.016 Android Open Source Project release (Android 17)</li><li>add workaround for upstream bug breaking using recovery mode sideloading for updating to Android 17 releases</li><li>revert in-process Opus codec sandboxed with LFI (Lightweight Fault Isolation) to dedicated sandboxed process in order to restore compatibility with hardware memory tagging and avoid likely holes in LFI</li><li>Sandboxed Google Play compatibility layer: add stubs for BluetoothLeBroadcast methods</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.159.0">version 149.0.7827.159.0</a></li></ul><p>All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026061801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026061600">2026061600</a></h3><p>This is our final release based on Android 16 QPR2/QPR3 since we've completed our initial port to Android 17 and are resolving regressions to prepare it for a public release very soon.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026061600">2026061600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026060600 release:</p><ul><li>skip replacing pairip Play Store installer check with Play Store source stamp checks for apps installed directly from the Play Store where the check will pass to avoid causing compatibility issues for apps with deeper pairip integration</li><li>hardened_malloc: add support for Cuttlefish build targets</li><li>Network Location: require TLSv1.3 for Apple and Apple China location services in addition to the GrapheneOS service</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.174</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.102.0">version 149.0.7827.102.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.114.0">version 149.0.7827.114.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-170">version 170</a></li><li>Speech Services: update to <a href="https://github.com/GrapheneOS/SpeechServices/releases/tag/3">version 3</a></li></ul><p>All of the Android 16 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026061601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-45515, CVE-2026-45531</li><li>High: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-0054, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0084, CVE-2026-28572, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28670, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45516, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026060600">2026060600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026060600">2026060600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026060100 release:</p><ul><li>Launcher: fix upstream bug causing the recents button to become unresponsive for users with third party launchers</li><li>replace validation of Play Store source stamps with a correct implementation (this isn't yet used for security-sensitive purposes but we plan to begin using it to replace security-relevant Play Store source checks in the near future)</li><li>replace implementation of using Play Store source stamps as a substitute for Play Store installer checks included as part of Play Store anti-tampering protection enabled by certain apps (this prevents using the apps when combined with the Play Integrity API store lising toggles)</li><li>Settings: correctly reset tethering offload developer setting when disabling developer options</li><li>Settings: add one-time reset of tethering offload developer setting to re-enable it for everyone who had it disabled by the upstream Android bug when disabling developer options</li><li>Settings: fix upstream null pointer exception bug in SettingsBasePreferenceFragment when listView is null which occurs with at least one of the developer options</li><li>Pixel 10a: add missing SELinux policy for Pixel Camera TPU usage</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.59.0">version 149.0.7827.59.0</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/5">version 5</a></li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/6">version 6</a></li></ul><p>All of the Android 16 security patches from the current July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026060601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662</li><li>High: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-0054, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0084, CVE-2026-28572, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28667, CVE-2026-28668, CVE-2026-28670, CVE-2026-28671</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026060100">2026060100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026060100">2026060100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026052400 release:</p><ul><li>full 2026-06-01 security patch level</li><li>fix Location access indicator to always properly display when only coarse location is granted too</li><li>kernel (Pixel): fix upstream use-after-free bug in Broadcom Wi-Fi driver caught by hardware memory tagging</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream out-of-bounds array read caught by hardware memory tagging in the DisplayPort driver caused by devices implementing the DisplayPort protocol incorrectly and the kernel driver not properly handling the incorrect data</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.89</li><li>Speech Services: update to <a href="https://github.com/GrapheneOS/SpeechServices/releases/tag/2">version 2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.48.0">version 149.0.7827.48.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/92">version 92</a></li></ul><p>All of the Android 16 security patches from the current July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026060101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662</li><li>High: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-0054, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0084, CVE-2026-28572, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28667, CVE-2026-28668, CVE-2026-28670, CVE-2026-28671</li><li>Unclassified: CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026052400">2026052400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026052400">2026052400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050900 release:</p><ul><li>add GrapheneOS Speech Services providing a local text-to-speech engine using a model trained by GrapheneOS with fully open source code and training data</li><li>set GrapheneOS TalkBack as the default accessibility service to support easily enabling it via the accessibility shortcut</li><li>Network Location: position estimation algorithm overhaul to improve accuracy, reliability and especially the consistency of results along with improving reporting the estimated accuracy</li><li>Sandboxed Google Play compatibility layer: add stub for NetworkStatsManager.queryDetailsForUidTag()</li><li>Sandboxed Google Play compatibility layer: stub CarrierConfigManager.getConfigForSubId for Android Auto</li><li>Keyboard: expand heuristic for working around Jetpack Compose TextField bug</li><li>remove android.hardware.telephony.satellite feature declaration since it's not supported by GrapheneOS and declaring the feature causes minor issues with recent Android Auto releases</li><li>Calculator: fix long click to paste not working on first run</li><li>Seedvault: allow new content provider for DAVx⁵ WebDAV provider (will be replaced with a better backup implementation in the future)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.173</li><li>kernel (6.1): update to 6.1.174</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.139</li><li>kernel (6.6): backport security patches for CVE-2026-46300 and CVE-2026-43503 which aren't exploitable for local privilege escalation from non-root on Android due to not permitting unprivileged use of user namespaces</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.88</li><li>kernel (Pixel): fix upstream bug in Samsung TEE DMA heap driver used by the PowerVR and Mali GPU drivers for DRM support causing a crash with kernel hardware memory tagging from it freeing a pointer with the tag stripped</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.167.0">version 148.0.7778.167.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.178.0">version 148.0.7778.178.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/149.0.7827.22.0">version 149.0.7827.22.0</a></li><li>set the patch level to 2026-05-05 instead of the officially equivalent 2026-05-01 since no patches were listed for 2026-05-05 for either Android or Pixels but not raising it to the equivalent higher value leads to confusion</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026052401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604, CVE-2026-28618, CVE-2026-28639</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28636, CVE-2026-28638, CVE-2026-28642, CVE-2026-28643, CVE-2026-28644, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28656, CVE-2026-28658, CVE-2026-28660</li><li>Unclassified: CVE-2026-0075, CVE-2026-28653</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050900">2026050900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050900">2026050900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050700 release:</p><ul><li>kernel (Pixel 8a, Pixel 9a): fix for an upstream Broadcom Wi-Fi bcm4383 driver memory corruption bug to avoid invalid memory accesses caught by the kernel hardware memory tagging enabled by GrapheneOS (the May 2026 Wi-Fi firmware + kernel driver update introduced this issue)</li><li>backport Broadcom Wi-Fi bcm4383 driver changes from CP21.260330.008 (Android 17 Beta 4) to avoid invalid memory accesses (this didn't end up resolving the hardware memory tagging crashes introduced in the May 2026 Pixel update but we kept this to fix additional issues)</li><li>disable buggy upstream IStatusBarNotificationHolder optimization via the upstream feature flag (no_sbnholder) due to it causing occasional system_server crashes from sending overly large Binder transactions</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591, CVE-2026-28604</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28607, CVE-2026-28609, CVE-2026-28612, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620</li><li>Unclassified: CVE-2026-28618</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050700">2026050700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050700">2026050700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050600 release:</p><ul><li>update Pixel kernel driver sources to May 2026 (this resolves the Pixel 8a and Pixel 9a issues resulting in the release for those being quickly cancelled after early Alpha testing due to the new firmware requiring driver changes)</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28594, CVE-2026-28596, CVE-2026-28602</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050600">2026050600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050600">2026050600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026050400 release:</p><ul><li>update Pixel firmware, driver libraries, HALs and other components backported from Android 16 QPR3 from the initial March 2026 release to the May 2026 release (CP1A.260505.005.A1)</li><li>Contact Scopes: add missing handling for QUERY_DEFAULT_ACCOUNT_FOR_NEW_CONTACTS_METHOD was added in Android 16</li><li>backport fix for stuck IME input from May 2026 Pixel update</li><li>bionic: avoid adding an extra guard page below the main thread's pthread_internal_t since it serves no purpose (the stack is in a dedicated mapping from the kernel so the stack guard is immediately below pthread_internal_t) and it causes a crash for incorrect anti-tampering code shared across many banking apps which reads /proc/self/maps to find the main thread's thread-local data including pthread_internal_t based on mapping name and then tries to access the internal libc data stored in an entirely internal libc format without checking if there's a guard page (these anti-tampering checks serve no valid security purpose, cause these apps to break on major Android releases and hinder OS security hardening due to compatibility issues with their incorrect code)</li><li>bionic: remove unnecessary extra naming for mappings to avoid 2 extra system calls for creating a thread</li><li>adevtool: fix update-carrier-settings command</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28594, CVE-2026-28596, CVE-2026-28602</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026050400">2026050400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026050400">2026050400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026042100 release:</p><ul><li>full 2026-05-05 security patch level (listed as 2026-05-01 due to 2026-05-05 not being officially defined)</li><li>disable registerQuicConnectionClosePayload optimization to fix VPN leak</li><li>Sandboxed Google Play compatibility layer: add shim for BluetoothAdapter.ACTION_REQUEST_ENABLE</li><li>apply active Dynamic Code Loading restrictions for Java inside isolated processes</li><li>add app API for checking Dynamic Code Loading restriction states</li><li>fully enable lockscreen widget support by default to avoid the swipe gesture being missing for the Pixel 10a and the whole feature being missing for the emulator</li><li>enable standard secure NFC mode by default which can be changed via Settings &gt; Connected devices &gt; Connection preferences &gt; NFC &gt; Require device unlock for NFC (note this only disables card emulation while locked rather than all uses of NFC)</li><li>backport upstream fix for getBubblePackageForLogging() crash</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.170</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.130</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>hardened_malloc: fix slightly non-uniform distribution of random u16 values used for randomizing slot selection, slab allocation quarantining and free slab quarantining</li><li>hardened_malloc: improve the robustness of disabling memory tagging against theoretical issues by making it fork-safe and adding more synchronization to avoid technically undefined parallel reads of the memory tagging state</li><li>hardened_malloc: improve handling of out-of-memory edge cases</li><li>hardened_malloc: improve sized deallocation hardening</li><li>libpng: backport fix for CVE-2026-33636</li><li>bionic: clamp the minimum size of the random guard region we add between the stack and pthread_internal_t (thread-local storage and other sensitive data) for secondary stack randomization to the page size to guarantee we always add a guard page protecting pthread_internal_t from stack buffer overflows</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/36">version 36</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.111.0">version 147.0.7727.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.49.0">version 148.0.7778.49.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.60.0">version 148.0.7778.60.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.60.1">version 148.0.7778.60.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/148.0.7778.96.0">version 148.0.7778.96.0</a></li><li>adevtool: add update-gservices-flag command for fetching gservices flags</li></ul><p>All of the Android 16 security patches from the current June 2026, July 2026, August 2026, September 2026, October 2026 and November 2026 Android Security Bulletins are included in the 2026050401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-27280, CVE-2026-28590, CVE-2026-28591</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0008, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28585, CVE-2026-28586, CVE-2026-28588, CVE-2026-28594, CVE-2026-28596, CVE-2026-28602</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026042100">2026042100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026042100">2026042100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040800 release:</p><ul><li>Launcher: backport fix from Pixel Launcher for the recents overview with third party launchers</li><li>Launcher: improve our implementation of hiding the app list when search is focused to more closely match Pixel Launcher</li><li>don't allow irregular secondary users (guest, demo or restricted) to have a private space</li><li>Settings: inherit user restrictions from full user to a nested private space and run a one-time task to add missing restrictions</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.167</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.1): backport SVE support for protected guests</li><li>kernel (6.1, 6.6, 6.12): backport fix for race conditions in USB gadget UVC driver causing crashes with the device as webcam feature including use-after-free detected by hardware memory tagging</li><li>kernel (6.6, 6.12): disable Android GKI vendor hooks for INIT_ON_FREE page zeroing to avoid Pixels deferring zero-on-free for reclaim (kswapd) via their driver tree since it reduces security to improve performance (the stock OS doesn't use INIT_ON_FREE but they tried to reduce the cost to be acceptable for the stock OS while we want the full security instead)</li><li>adevtool: change added Cape cellular radio carrier configuration entry to use USCC (1952) instead of ATT (1187) to avoid outbound call issues for users opting into using their new setup early (stock Pixel OS will add the same entry but they take months to handle it so it was submitted to us too)</li><li>hardened_malloc: improve handling of out-of-memory edge cases</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.101.0">version 147.0.7727.101.0</a></li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026042101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581, CVE-2026-28585, CVE-2026-28586</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040800">2026040800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040800">2026040800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040600 release:</p><ul><li>full 2026-04-05 security patch level</li><li>update Pixel firmware, driver libraries, HALs and other components backported from Android 16 QPR3 from the initial March 2026 release to the April 2026 release (CP1A.260405.005)</li><li>Settings: ProfileSelectFragment: backport Android 16 QPR3 to ease future porting</li><li>Settings: ProfileSelectFragment: fix crash caused by upstream bug when opening credential settings from private profile</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>kernel (6.12): temporarily disable RANDSTRUCT and LTO due to incompatibility with Rust since Android has started using the Rust ashmem rewrite (CFI still works without LTO due to using kCFI)</li><li>kernel (6.12): switch to Rust ashmem implementation</li><li>kernel (6.12): enable building Rust Binder implementation</li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0051, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040600">2026040600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040600">2026040600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026040300 release:</p><ul><li>full 2026-04-01 security patch level</li><li>make temporary biometric lockouts into permanent lockouts and ensure only framework can clear lockout to make sure our 5 attempt limit is always properly enforced across devices with different implementations of biometric unlock instead of batches of 5 temporary lockouts followed by permanent lockout after 20 attempts</li><li>Launcher: fix layout for search bar which is broken in upstream AOSP due to lack of a predictive service</li></ul><p>All of the Android 16 security patches from the current May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026040300">2026040300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026040300">2026040300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026032000 release:</p><ul><li>Keyboard: add heuristic for detecting the input field is a Jetpack Compose TextField to work around a bug in Compose's implementation breaking backspace functionality by falling back to a legacy approach</li><li>fix upstream use-after-free bug caught by MTE in the Pixel HWC3 service when an external display connects which causes soft reboots</li><li>fix StrictMode BackgroundActivityLaunchCallback leak which was leading to exhaustion of the binder proxy object limit causing a crash</li><li>Contact Scopes: resolve app compatibility issue causing crashes due to missing handling for _count queries when scopes are empty</li><li>Sandboxed Google Play compatibility layer: improve the user experience for using Google Messages RCS by showing users the access it requires is being requested along with overhauling the implementation</li><li>Sandboxed Google Play compatibility layer: permit Android Auto retrieving A2DP connection policy when the special access permission for wireless Android Auto is granted to improve compatibility beyond the stub in GmsCompatConfig version 169</li><li>Pixel 10a: add missing Multiuser app for multi-user switcher widget</li><li>Pixel 10a: backport Android 16 QPR3 GNSS HAL to resolve a mismatch resulting in inaccurate GNSS data</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.129</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.77</li><li>adevtool: update the cellular modem carrier configuration database for Cape to fix VoWifi support prior to the change shipping in the stock Pixel OS</li><li>adevtool: heavily optimize carrier config decoding</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-168">version 168</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-169">version 169</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.164.0">version 146.0.7680.164.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.24.0">version 147.0.7727.24.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.0">version 147.0.7727.49.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.1">version 147.0.7727.49.1</a></li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026, August 2026, September 2026 and October 2026 Android Security Bulletins are included in the 2026040301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080, CVE-2026-0097, CVE-2026-21352, CVE-2026-21353</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079, CVE-2026-0084, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-28572, CVE-2026-28580, CVE-2026-28581</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026032000">2026032000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026032000">2026032000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)</li></ul><p>Changes since the 2026030700 release:</p><ul><li>add experimental Pixel 10a support</li><li>Launcher: change app drawer search bar to cancelling search when the back action is invoked instead of the query becoming empty</li><li>backport SELinux policy for CameraX extensions property used by the Pixel Camera HAL from Android 16 QPR3</li><li>hardened_malloc: multiple small optimizations to improve performance</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.166</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.127</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.76</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.65.1">version 146.0.7680.65.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.111.0">version 146.0.7680.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.115.0">version 146.0.7680.115.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.119.0">version 146.0.7680.119.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.153.0">version 146.0.7680.153.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/91">version 91</a></li><li>switch to cross-device gmscompat_lib key for 10th gen Pixels</li><li>adevtool: add support for keeping only certain unpacked images to help with constrained storage</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026032001 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073, CVE-2026-0080</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0079</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030700">2026030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030700">2026030700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030500 release:</p><ul><li>update Pixel Camera HAL to CP1A.260305.018 (Android 16 QPR3) to resolve compatibility issues with the backported Android 16 QPR3 kernel drivers</li><li>Pixel 10 Pro Fold: change thermal info configuration to work around an incompatibility with the Android 16 QPR3 kernel device tree</li><li>Setup Wizard: add opt-in toggles for geocoding to the Location services page since we now have a GrapheneOS geocoding service able to handle a large number of users</li><li>replace "OpenStreetMaps" with the correct "OpenStreetMap" for the geocoder server option name</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.65.0">version 146.0.7680.65.0</a></li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030500">2026030500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030500">2026030500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030200 release:</p><ul><li>full 2026-03-05 security patch level</li><li>integrate extra security patches not included in the Android Security Bulletin from the March 2026 Android 16 security tag release</li><li>update Pixel kernel sources to CP1A.260305.018 (Android 16 QPR3)</li><li>update Pixel firmware and a large portion of the driver libraries/HALs to CP1A.260305.018 (Android 16 QPR3)</li><li>fix Network permission enforcement for MediaPlayerService clients by closing a bypass caused by an upstream Android vulnerability for INTERNET permission enforcement caused by using case-sensitive rather than case-insensitive string comparisons</li><li>rename geocoder options to "GrapheneOS server" and "OpenStreetMaps server" since we're now self-hosting Nominatim instead of providing a proxy to the OpenStreetMaps instance</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030200">2026030200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030200">2026030200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026030100 release:</p><ul><li>full 2026-03-01 security patch level</li></ul><p>All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48649, CVE-2025-48652, CVE-2026-0016, CVE-2026-0018, CVE-2026-0022, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026030100">2026030100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026030100">2026030100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026021200 release:</p><ul><li>SystemUI: migrate to the modern lockscreen infrastructure (smartspace) for showing lockscreen device status info to avoid many upstream bugs caused by AOSP still using the legacy lockscreen infrastructure no longer used on the stock Pixel OS (this allows us to revert a bunch of downstream fixes we were using)</li><li>Settings: don't allow disabling eSIM when eSIM management support is disabled since it can persistently prevent using the eSIMs without using ADB shell to undo it</li><li>modify our multicast firewall to stop dropping route advertisements received on the VPN interface which sometimes breaks IPv6 connectivity</li><li>fix rare edge preventing dismissing the UI for our 2-factor fingerprint unlock feature</li><li>Setup Wizard: add opt-in toggles for network-based location and always available Wi-Fi scanning to the Location services page</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): raise lockdown mode from integrity to confidentiality mode to match the other devices</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): add workaround for an upstream arm64 KVM bug breaking booting with lockdown in confidentiality mode</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.163</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.126</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.73</li><li>hardened_malloc: update libdivide to 5.3.0</li><li>hardened_malloc: fix handling one form of realloc from small allocations made with alignment above PAGE_SIZE (no known real world examples and it would be crashing if it was happening since it causes internal invalid accesses unable to go outside the bounds of the protected metadata region which is mainly PROT_NONE)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.75.0">version 145.0.7632.75.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.109.0">version 145.0.7632.109.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.120.0">version 145.0.7632.120.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.31.0">version 146.0.7680.31.0</a></li><li>adevtool: handle Node.js fs.cp behavior change</li><li>adevtool: update dependencies</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2025-64783, CVE-2025-64784, CVE-2025-64893, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026021200">2026021200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026021200">2026021200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026020600 release:</p><ul><li>Sandboxed Google Play compatibility layer: add toggle for granting Play services access to ICC auth in order to support RCS with carriers requiring it for RCS in Google Messages including T-Mobile (see <a href="https://grapheneos.org/usage#rcs">RCS usage guide</a>)</li><li>Launcher: fix rare upstream crash when switching users</li><li>Dialer: add new opt-in implementation of call recording using the same framework APIs as Google Dialer with the goal of improving functionality (handover support) and robustness (currently an opt-in setting for testing and then it will replace the previous implementation)</li><li>kernel (6.1, 6.6, 6.12): re-enable standard forced module signing with a workaround to make pKVM compatible with it</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.162</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.123</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.69</li><li>change default quick tile configuration for the new UI (replacing cast, wallet and device controls with camera, microphone and NFC toggles by default)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.45.1">version 145.0.7632.45.1</a></li><li>update release signing to handle AOSP APEX changes</li><li>migrate otatools.zip changes to Android's modern build system (soong)</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026021201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026020600">2026020600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026020600">2026020600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026020400 release:</p><ul><li>raise declared Android security patch level to 2026-02-05 which has been provided since we moved to Android 16 QPR2 in December (was meant to be declared in the previous release)</li><li>add cross-SIM calling support (making calls using a SIM via the mobile data provided by another SIM similarly to Wi-Fi calling); requires Automatic data switching in SIM settings, and existing installs may need to toggle Automatic data switching off and on to enable cross-SIM calling</li><li>extend our carrier override feature with a toggle for forcing the availability of cross-SIM calling support</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.45.0">version 145.0.7632.45.0</a></li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026020601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049, CVE-2026-0052</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026020400">2026020400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026020400">2026020400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026012800 release:</p><ul><li>raise declared Android security patch level to February 2026 which has been provided since we moved to Android 16 QPR2 in December (currently declared as 2026-02-01 even though 2026-02-05 has been provided since Android 16 QPR2 but it wasn't worth restarting the builds)</li><li>update to February 2026 Pixel driver/firmware code providing the 2026-02-05 Pixel security patch level</li><li>Dialer: fix call recording button state after fragment re-creation to avoid showing call recording as active when it isn't</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.121</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/145.0.7632.26.0">version 145.0.7632.26.0</a></li><li>switch to 64-bit-only Vanadium releases for devices without 32-bit support (7th gen Pixels and later)</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/34">version 34</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/35">version 35</a></li><li>switch from 6.6 kernel branch to 6.12 kernel branch for emulator builds (used for development) to match AOSP since Android 16 QPR2</li></ul><p>All of the Android 16 security patches from the current March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026020401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026012800">2026012800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026012800">2026012800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026012100 release:</p><ul><li>FusedLocationProvider: restore pre-16-QPR1 GNSS usage policy of using GNSS for both balanced and high power requests instead of only high power requests since many GrapheneOS users don't enable network location and network location may not always be accessible such as temporarily not having internet access</li><li>Sandboxed Google Play compatibility layer: add special case for sandboxed Play services making it so users granting the SMS permission enables reading SMS addressed to apps using the Google Play services client library (Android 16 QPR2 prevented using the SMS permission to read SMS addressed to other apps so a special case is needed for apps which use Google Play services to handle SMS-based authentication)</li><li>Sandboxed Google Play compatibility layer: prevent sandboxed Play Store attempting to install the "Device configuration" package which is not used on GrapheneOS and serves no purpose</li><li>avoid compatibility issues with misguided anti-tampering checks in a tiny subset of apps by changing the initial call stack for secure app spawning (exec spawning) to match the standard zygote-based spawning so these apps no longer detect secure spawning as an altered call stack indicating tampering</li><li>Settings: require device restart after changing the secure app spawning setting</li><li>Sandboxed Google Play compatibility layer: update Android Auto configuration UI to Material 3 Expressive</li><li>add workaround for upstream system_server startUserInBackgroundTemporarily crash</li><li>fix GrapheneOS support for recording permission usage history for a broader set of permissions</li><li>Dialer: set CallStyle for call notifications to improve the user interface and replace our temporary workaround of disabling notification grouping for it</li><li>Network Location: rename "GrapheneOS proxy" option to "GrapheneOS Apple proxy" for clarity</li><li>Network Location: add "Apple China" server choice required for China data due to China's laws about mapping the country (currently no proxy due to poor connectivity to and from China causing reliability issues with connecting to Apple's servers in China from ours but we plan to offer it as an option in the future)</li><li>Pixel 8a, 9th gen Pixels and 10th gen Pixels: disable NTP usage in Samsung gnssd which isn't as useful on GrapheneOS due to reducing the system time update threshold from 2000ms to 50ms along with avoiding us needing to redirect this to our own NTP service as we did for Qualcomm xtra-daemon</li><li>update code for disabling reporting of harmless fingerprint-service.goodix crash</li><li>improve user interface for Network/Sensors permissions in the permission manager</li><li>fix minor Material 3 Expressive styling issues for the Contact Scopes and Storage Scopes configuration UI</li><li>adevtool: raise minimal supported Node.js version to 24</li><li>adevtool: disallow running adevtool as root</li><li>adevtool: check for presence of prebuilts dirs at startup</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.67</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.109.0">version 144.0.7559.109.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026012100">2026012100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026012100">2026012100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026011300 release:</p><ul><li>fix an upstream infinite loop bug in ProtoFieldFilter.skipBytes() causing an upstream system_server issue leading to the OS being unusable in early boot for a tiny subset of users since Android 16 QPR2 (there are a bunch of reports of these symptoms with the stock Pixel OS)</li><li>libpng: backport security patches</li><li>remove unused INTERNET permission from Pixel Camera Services since GrapheneOS doesn't support the Pixel Connected Cameras feature</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.161</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.66</li><li>kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): enable lockdown in integrity mode which is a major step towards matching the other devices using it in confidentiality mode</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.59.0">version 144.0.7559.59.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.59.1">version 144.0.7559.59.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.76.0">version 144.0.7559.76.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.76.1">version 144.0.7559.76.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/144.0.7559.90.0">version 144.0.7559.90.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044</li><li>High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0036</li><li>Unclassified: CVE-2026-0035</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026011300">2026011300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026011300">2026011300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026011000 release:</p><ul><li>update to January 2026 Pixel driver/firmware code for the subset of devices with a January 2026 release</li><li>allow user to set any account as the default contacts account (since Android 16 QPR1, this was restricted to Google accounts for the stock Pixel OS and nothing permitted at all for AOSP)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.159</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision</li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026011301 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026011000">2026011000</a></h3><p>Support for 10th gen Pixels is no longer considered experimental.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026011000">2026011000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2026010800 release:</p><ul><li>reimplement the standard Android USB data signal API with our hardware + software USB blocking functionality to preserve support for the device admin and lockdown mode features for fully toggling off USB while upgrading it to use hardware blocking (this was omitted in the previous Alpha-only release)</li><li>fix regression in the last release causing sandboxed Google Play breakage in a subset of secondary users caused by the phenotype flag changes in the previous release</li><li>Sandboxed Google Play compatibility layer: add stub for ContentResolver.acquireUnstableProvider()</li><li>fix the Terminal virtual machine management app not working in a secondary user Private Space (GrapheneOS adds the ability to use the Terminal app in secondary users and also adds the ability to use Private Space in secondary users, so the combination of those things resulted in this being possible but the upstream code was incompatible with it)</li><li>Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold: add high EMF (PWM) mode opt-in to the Settings app</li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026011001 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2026010800">2026010800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2026010800">2026010800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025122500 release:</p><ul><li>raise declared Android security patch level to 2026-01-05 which has been provided since we moved to Android 16 QPR2 in December due to Pixels shipping CVE-2025-54957 in December</li><li>re-enable the system keyboard package at boot if the package is disabled (does not change keyboard settings)</li><li>switch to the system keyboard when device boots to the Safe Mode</li><li>add "Reboot to Safe Mode" power menu button in Before First Unlock state to make Safe Mode much more discoverable for working around app issues such as a broken third party keyboard</li><li>add workaround for upstream UsageStatsDatabase OOM system_server crash</li><li>add workaround for upstream WindowContext.finalize() system_server crash</li><li>disable buggy upstream disable_frozen_process_wakelocks feature causing system_server crashes for some users</li><li>Sandboxed Google Play compatibility layer: fix phenotype flags not working in Play services clients</li><li>Sandboxed Google Play compatibility layer: add MEDIA_CONTENT_CONTROL as a requested permission for Android Auto as part of our toggles for it to avoid needing to grant the far more invasive notification access permission</li><li>Sandboxed Google Play compatibility layer: extend opt-in Android Auto Bluetooth support to allow A2dpService.setConnectionPolicy() to fix Bluetooth functionality (previously worked around with a GmsCompatConfig update avoiding a crash)</li><li>switch to new upstream PackageInstallerUI implementation added in Android 16 QPR2 and port our changes to it</li><li>update SQLite to 3.50.6 LTS release</li><li>add an extra layer of USB port protection on 10th gen Pixels based on upstream functionality to replace our USB gadget control which was causing compatibility issues with the Pixel 10 USB drivers</li><li>allow SystemUI to access NFC service on 10th gen Pixels to fix the NFC quick tile</li><li>disable the upstream Android USB data protection feature since it conflicts with our more advanced approach and causes issues</li><li>issue CHARGING_ONLY_IMMEDIATE port control command in more cases</li><li>fix an issue in our infrastructure for spoofing permission self-checks breaking automatically reading SMS one-time codes for certain apps</li><li>add workaround for upstream KeySetManagerService system_server crash causing a user to be stuck on an old OS version due to it causing a boot failure when booting a the new OS version after updating</li><li>wipe DPM partition on 10th gen Pixels as part of installation as we do on earlier Pixels since it's always meant to be zeroed on production devices</li><li>Settings: disable indexing of the unsupported "Parental controls" setting which is not currently available in AOSP</li><li>Settings: disable redundant indexing of widgets on lockscreen contents which is already indexed another way</li><li>skip all pseudo kernel crash reports caused by device reboot to avoid various false positive crash reports</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.192.0">version 143.0.7499.192.0</a></li></ul><p>All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026010801 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48615, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025122500">2025122500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025122500">2025122500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121700 release:</p><ul><li>restore support for bypassing carriers disallowing choosing the cellular network mode (this was lost in a recent major version migration such as the port to Android 16 QPR1 but we aren't sure exactly when it regressed)</li><li>remove poorly designed upstream end session button on the lockscreen (it remains available in the power menu)</li><li>enable feature flag for new upstream end session button in the user switcher</li><li>switch to vendor files from 2nd December 2025 release (BP4A.251205.006.E1) for devices with it available</li><li>enable lockscreen widget support</li><li>fix upstream system_server crash in NotificationHistoryProtoHelper</li><li>Wi-Fi HAL: ignore debug logging requests on all Pixels with MTE support to avoid a crash from detecting an invalid memory access in the upstream code</li><li>Sandboxed Google Play compatibility layer: add support for redirecting Google Play location service requests from within Google Play services itself which means the GrapheneOS provided network location will work for internal Play services features such as Google Maps location sharing when redirecting to the OS is enabled (which is the default) and the Location permission is granted to it</li><li>Sandboxed Google Play compatibility layer: force redirecting Google Play location service requests from within Google Play services and Android Auto when the Location permission is disabled for better error handling (neither properly handles the Location permission not being granted since it's always granted on any Google Mobile Services OS in practice instead of being explicitly opt-in)</li><li>Sandboxed Google Play compatibility layer: fix a compatibility issue with the Chromium test suite</li><li>Network Location: improve position estability accuracy and stability</li><li>Network Location: prevent potential division by zero exception</li><li>Network Location: improve experimental Wi-Fi RTT support which is still disabled in production</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.119</li><li>kernel (6.6): disable CONFIG_TLS to reduce attack surface</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.63</li><li>kernel (6.12): disable CONFIG_TLS to reduce attack surface</li><li>include configuration for thermometer on 10th gen Pixels</li><li>adevtool: auto-detect filesystem image type (ext4 vs. EROFS)</li><li>adevtool: add support for canary builds</li><li>adevtool: improve performance</li><li>remove obsolete workaround for using a prebuilt recovery extension</li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025122501 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48561, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121700">2025121700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121700">2025121700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121200 release:</p><ul><li>add workaround for upstream system_server WallpaperManagerService.hasPermission() crash</li><li>fix upstream system_server crash in NotificationHistory.getPooledStringsToWrite()</li><li>Launcher: add a workaround for upstream QuickstepModelDelegate.getContainer() crash</li><li>set initial port security state at an earlier boot stage to improve debugging on production builds where the port state has been changed from the default "Charging-only when locked" to "Charging-only when locked, except before first unlock" or "On"</li><li>use default desktop mode configuration since our changes are no longer needed to enable features and caused crashes for at least 1 user which were addressed with an out-of-band release prior to this one</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): add back recent dma-buf changes now that an upstream use-after-free bug is resolved</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.118</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.146.0">version 143.0.7499.146.0</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121701 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121200">2025121200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121200">2025121200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025121000 release:</p><ul><li>disable notification summaries and organizer features due to AOSP and GrapheneOS lacking the AI models used to implement these features</li><li>add workaround for notification background appearance regression in Android 16 QPR2</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.109.0">version 143.0.7499.109.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-167">version 167</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121201 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025121000">2025121000</a></h3><p>This is our first non-experimental release based on Android 16 QPR2 after our initial experimental 2025120800 release.</p><p>The change to the style of notification backgrounds is an upstream regression rather than an intentional change to a more minimal style. It will be fixed in a subsequent release since we decided it isn't important enough to delay this.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025121000">2025121000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025120400 release:</p><ul><li>full 2025-12-05 security patch level</li><li>rebased onto BP4A.251205.006 Android Open Source Project release (Android 16 QPR2)</li><li>disable promotion of identity check feature not currently present in GrapheneOS due to depending on privileged Google Mobile Services integration</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-166">version 166</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121001 security preview release. List of additional fixed CVEs:</p><ul><li>High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025120400">2025120400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025120400">2025120400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025112100 release:</p><ul><li>full 2025-12-01 security patch level (has already been fully provided by our security preview releases for at least a month and most of the patches since September)</li><li>add experimental support for the Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold (there were 2 standalone experimental releases prior to this via 2025112500 and 2025113000 along with corresponding security preview releases for each)</li><li>Cell Broadcast Receiver: switch back to our modified text for the presidential alerts toggle</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.158</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.116</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.60</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/90">version 90</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.0">version 143.0.7499.34.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.1">version 143.0.7499.34.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.34.2">version 143.0.7499.34.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/143.0.7499.52.0">version 143.0.7499.52.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-164">version 164</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-165">version 165</a></li></ul><p>All of the Android 16 security patches from the current January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025120401 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2026-0006</li><li>High: CVE-2025-26447, CVE-2025-32348, CVE-2025-48578, CVE-2025-48579, CVE-2025-48582, CVE-2025-48585, CVE-2025-48587, CVE-2025-48609, CVE-2025-48622, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008, CVE-2026-0009, CVE-2026-0010</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025112100">2025112100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025112100">2025112100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025111800 release:</p><ul><li>fix regression from our Android 16 QPR1 port causing enabling the Network permission to not work without a reboot</li><li>adevtool: fix SELinux policy handling issue causing fingerprint registration issues on the devices with power button fingerprint readers (Pixel Tablet, Pixel Fold, Pixel 9 Pro Fold) with Android QPR1</li><li>fix port of our notification forwarding between user profiles feature to Android 16 QPR1</li><li>enable new UI customization picker UI from Android 16 QPR1</li><li>Wallpaper Picker: don't use the CuratedPhotos categories which aren't setup in AOSP</li><li>Wallpaper Picker: hide the always-empty wallpaper carousel</li><li>Wallpaper Picker: enable integration of the embedded photo picker</li><li>System Updater, Sandboxed Google Play compatibility layer: switch to Material 3 Expressive theme for Settings app menus</li><li>Cell Broadcast Receiver: fix presidential alerts toggle added by GrapheneOS not being enabled without the main emergency alerts toggle being toggled off and on</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.171.0">version 142.0.7444.171.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025112101 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025111800">2025111800</a></h3><p>Following our experimental releases, this is our first non-experimental release based on Android 16 QPR1, the first quarterly release of Android 16. Android 16 QPR1 was pushed to the Android Open Source Project on November 11 rather than September 3 as expected. This is a very large quarterly release with more prominent user-facing improvements than Android 16 provided compared to Android 15 QPR2.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025111800">2025111800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025110800 release:</p><ul><li>rebased onto BP3A.250905.014 Android Open Source Project release (Android 16 QPR1)</li><li>Terminal (virtual machine management app): re-enable GUI support now that the surfaceflinger crashes are resolved upstream by Android 16 QPR1</li><li>adevtool: massive overhaul entirely replacing the small remnants of the Pixel device trees to fix several regressions introduced since Android 16 such as charging mode booting into the regular OS and to prepare for adding 10th gen Pixel devices via automated device support without any need for device trees to use as a reference</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>raise declared patch level to 2025-11-05 which has already been provided in GrapheneOS since our regular <a href="https://grapheneos.org/releases#2025090200">2025090200</a> release (not a security preview) since the patches were included in the September security preview and were then pushed to AOSP despite not being listed in the bulletin along with there being no Pixel Update Bulletin patches for November 2025</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.158.0">version 142.0.7444.158.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025111801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>The official Android security preview patches are for the initial release of Android 16 and we had to port the patches to Android 16 QPR1. This resulted in it taking significantly longer to be available. Due to this, 2025111801 also bundles Vanadium 142.0.7444.171.0 which was released through our App Store after the regular OS release but prior to the security preview OS release. It's otherwise a normal security preview release with no non-security-preview patch related changes beyond the Vanadium release being included.</p><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025110800">2025110800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025110800">2025110800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025110600 release:</p><ul><li>adevtool: fully automate handling SoC and radio firmware image backports, which resolves an issue with a version string mismatch in the previous release for the initial installation process which resulted in us cancelling the Stable channel release</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.138.1">version 142.0.7444.138.1</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025110600">2025110600</a></h3><p>Both of the November 2025 patches have been provided in our regular non-security-preview releases for over a month, so we've already had the 2025-11-05 Android security patch level for over a month. Our patch level is set based on providing both the Android and Pixel security patches, so we're leaving it at 2025-11-01 until the Pixel stock OS release and Pixel Update Bulletin are published. The stock Pixel OS also included both November 2025 patches in early September. We expect they made a 2nd October release to ship the November carrier changes and will make a release in mid-November with patches from future Android Security Bulletins.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025110600">2025110600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102800 release:</p><ul><li>raise declared patch level to 2025-11-01 which has already been provided in GrapheneOS since our regular <a href="https://grapheneos.org/releases#2025090200">2025090200</a> release (not a security preview) since the patches were included in the September security preview and were then pushed to AOSP despite not being listed in the bulletin</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): keep POSIX_MQUEUE disabled to avoid increasing attack surface</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.114</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>adevtool: switch to obtaining Android 16 QPR1 backports from the latest November releases for relevant Pixels (there are no security patches listed for the Android or Pixel bulletins and not all Pixels received the tiny release)</li><li>Settings: add 1 second delay for approving device admin activation to mitigate tapjacking (this matches the 1 second delay we add to both permission prompts and ADB authorization prompts which is currently not configurable)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.138.0">version 142.0.7444.138.0</a></li></ul><p>All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48631, CVE-2026-0006</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102800">2025102800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102800">2025102800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102600 release:</p><ul><li>Sandboxed Google Play compatibility layer: temporarily limit system service override infrastructure added for GmsFontProvider shim to Pixel Camera to work around certain banking apps detecting it as tampering (we can change the approach to avoid this to enable it for all apps using the Google Play client libraries again, especially since we want to expand it to improve app compatibility without Play services installed)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.112</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.53</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102801 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102600">2025102600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102600">2025102600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102300 release:</p><ul><li>Sandboxed Google Play compatibility layer: add shim implementation of GmsFontProvider to prevent crashes of apps depending on Play services when it's missing or disabled (restores support for using Pixel Camera without Play services)</li><li>Sandboxed Google Play compatibility layer: extend shim for background service starts to address edge cases where a foreground service is required</li><li>Sandboxed Google Play compatibility layer: fix NoOpPrewarmService chain crash in Pixel Camera caused by lack of privileged OS integration</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/142.0.7444.48.0">version 142.0.7444.48.0</a></li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102601 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102300">2025102300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102300">2025102300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025102200 release:</p><ul><li>fix signing the GmsCompatLib package with a dedicated cross-device key, which was added in the last release but wasn't being replaced by a release key and blocked moving the last release past Alpha</li><li>kernel (6.12): update to latest GKI LTS branch revision</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025102200">2025102200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025102200">2025102200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025100900 release:</p><ul><li>adevtool: add satellite eSIM overlays to avoid the special Skylo eSIM on 9th/10th gen Pixels being listed as a regular eSIM and being possible to erase with the regular eSIM erase functionality</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.111</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.52</li><li>System Updater: prevent reboot and security preview notifications from timing out after 3 days which is standard behavior since Android 15 QPR1</li><li>System Updater: mark notification permission as fixed to prevent disabling overall notifications but exclude the channels for progress, errors and already up to date notifications from it so that only reboot and security preview notifications are mandatory</li><li>Sandboxed Google Play compatibility layer: add support for overriding BinderProxy transactions</li><li>Sandboxed Google Play compatibility layer: add support for out-of-band updates to GmsCompatLib</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.111.0">version 141.0.7390.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.122.0">version 141.0.7390.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-163">version 163</a></li><li>raise emulator super / dynamic partition size due to reaching the limit in some cases</li><li>adevtool: prefer prebuilt AOSP JDK 21</li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025102201 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593, CVE-2025-48631</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025100900">2025100900</a></h3><p>One of the changes in this release should result in Google Messages RCS working for users receiving a verification error caused by Play Store checking for an emulator with an easy to bypass check. It was already working for many users without this but this should get it working for everyone else.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025100900">2025100900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025100300 release:</p><ul><li>raise security patch level to 2025-10-05 since it's already provided without applying any additional patches</li><li>System Updater, Setup Wizard: integrate support for recommending opting into security preview releases during the initial Owner user setup and for existing users via a persistent notification which is disabled after making an explicit choice on whether to use security preview releases (this is necessary to inform all users about the option with an explicit choice)</li><li>Settings: add support for forcing VoWiFi availability</li><li>Settings: improve the carrier configuration override by improving the summaries, adding detailed descriptions and using clarifying the options force features to be available since there are also toggles for directly enabling/disabling the features in the main SIM settings screen</li><li>Sandboxed Google Play compatibility layer: fix a Google Messages RCS compatibility issue by removing the error string for the missing privileged permission from SurfaceFlinger::doDump() to make a DroidGuard check pass</li><li>Sandboxed Google Play compatibility layer: make Play Store ignore app auto-install config</li><li>Sandboxed Google Play compatibility layer: fix Build.getSerial() shim to fix an Android Auto issue</li><li>Sandboxed Google Play compatibility layer: add stub for TelephonyManager.getImei()</li><li>Sandboxed Google Play compatibility layer: add stub for Window.setHideOverlayWindows() to replace reliance on a feature flag override via GmsCompatConfig</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.155</li><li>update test suite to handle our carrier overrides support</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.70.0">version 141.0.7390.70.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/90">version 90</a></li></ul><p>All of the Android 16 security patches from the current November 2025, December 2025 and January 2026 Android Security Bulletins are included in the 2025100901 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025100300">2025100300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025100300">2025100300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025092700 release:</p><ul><li>add support for force enabling VoLTE, VoNR and 5G for carriers where those aren't supported with the standard configurations</li><li>revert backport of Pixel Wi-Fi extension APEX from Android 16 QPR1 due to it causing a system_server crash since it needs changes there too (this does not reduce the patch level)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.154</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.108</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.49</li><li>update SQLite to 3.44.5 LTS release</li><li>Network Location, System Updater: add new Let's Encrypt roots to TLS key pinning configuration</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-162">version 162</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/89">version 89</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025100301 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>CVE-2025-48595 was fixed in the regular GrapheneOS 2025100300 release and is no longer listed.</p><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025092700">2025092700</a></h3><p>This release adds official support for using RCS in Google Messages. Using this requires granting the Phone permission to Play services to provide carrier information to it, granting the required permissions to Google Messages and then setting Google Messages as the current carrier messaging app. Setting an app as the carrier messaging app provides it with device identifier access which is documented in our FAQ. However, Google Messages is a special case where part of the implementation is in Play services. We've dealt with this by special casing the device identifier permission check to detect when the user has granted this access to the official Google Messages app which then also provides the official Play services app with the same access. This doesn't provide any extra access in practice since Google Messages shares the information with Play services.</p><p>Re-enabling RCS after disabling it isn't expected to work yet and you'll need to clear the app data to enable it.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025092700">2025092700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025092500 release:</p><ul><li>add SystemUI and Settings integration for detecting and notifying Pixel 6a users with batteries impacted by the fire hazard issue resulting in capacity and charging being throttled along with directing users to the support options for getting a free battery replacement, $150 credit or $100 cash as compensation for the faulty battery (a subset of this will be replaced by AOSP code when Android 16 QPR1 is finally pushed to AOSP)</li><li>Sandboxed Google Play compatibility layer: add request for the unprivileged <code>READ_PHONE_NUMBERS</code> permission to Play services which users can manually grant via the Phone permission since it's needed for RCS activation but is not requested since they request the privileged permission instead</li><li>Sandboxed Google Play compatibility layer: when users have granted device identifier access to the official Google Messages app by setting it as the default SMS/MMS/RCS app</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.43.0">version 141.0.7390.43.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/141.0.7390.43.1">version 141.0.7390.43.1</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025092701 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48595, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025092500">2025092500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025092500">2025092500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025091900 release:</p><ul><li>System Updater: add support for opting into security preview releases</li><li>backport more cellular related code from Android 16 QPR1</li><li>backport Pixel Wi-Fi extension APEX from Android 16 QPR1</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.207.0">version 140.0.7339.207.0</a></li></ul><p>All of the Android 16 security patches from the current November 2025 and December 2025 Android Security Bulletins are included in the 2025092501 security preview release. List of additional fixed CVEs:</p><ul><li>Critical: CVE-2025-48593</li><li>High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2024-43766, CVE-2025-22420, CVE-2025-22432, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48544, CVE-2025-48555, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48581, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48595, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48607, CVE-2025-48609, CVE-2025-48611, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621</li></ul><p>For detailed information on security preview releases, see our <a href="https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases">post about it</a>.</p></article><article><h3><a href="https://grapheneos.org/releases#2025091900">2025091900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025091900">2025091900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025091000 release:</p><ul><li>backport latest carrier and cellular radio configurations from Android 16 QPR1</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.152</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.104</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.47</li><li>kernel (6.6): prepare for usage on bare metal arm64 devices by setting up arm64 emulator builds (Pixel 10 uses 6.6 and earlier Pixels will likely move to it soon)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.155.0">version 140.0.7339.155.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025091000">2025091000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025091000">2025091000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090800 release:</p><ul><li>full 2025-10-01 security patch level</li><li>partially backport Android 16 QPR1 Pixel userspace device support: RIL, eSIM, TPU and NeuralNetworks (deprecated)</li><li>kernel (6.1): roll back recent upstream Android GKI dma-buf changes due to a few MTE crash reports</li><li>kernel (6.1, 6.6, 6.12): disable unused memory hotplug support</li><li>kernel (6.1, 6.6, 6.12): fix linear region randomization by dropping memory hotplug support (see <a href="https://project-zero.issues.chromium.org/issues/434208461">the Project Zero issue</a> where the upstream Linux maintainers decided not to fix the issue)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.45</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.123.0">version 140.0.7339.123.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090800">2025090800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090800">2025090800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090600 release:</p><ul><li>backport the rest of the Android 16 QPR1 Pixel firmware (Bluetooth, Wi-Fi, GNSS, UWB, NFC, secure element, GPU, AOC, TPU and GXP)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090600">2025090600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090600">2025090600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090500 release:</p><ul><li>Pixel Tablet: fix regression for install zips in the previous release causing a version check for non-existent cellular baseband firmware to fail when doing the initial installation</li><li>add back Git commit metadata for the kernel image and modules by setting an environment variable to use the repo metadata from the Pixel kernel tarballs</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090500">2025090500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090500">2025090500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090300 release:</p><ul><li>move to new monolithic Pixel kernel repository setup with a single repository for Pixels and our portable Generic Kernel Image repository as a submodule to more easily handle Pixel kernel sources being released as tarballs instead of Git tags (Git metadata for the kernel image and modules will be added back in the next release)</li><li>update to Android 16 QPR1 kernel drivers and kernel build system to ship the security patches prior to Android 16 QPR1 being released to AOSP</li><li>update Pixel SoC and cellular radio firmware to the Android 16 QPR1 releases to ship the security patches prior to Android 16 QPR1 being released to AOSP</li><li>kernel (6.12): update to latest GKI LTS branch revision</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/32">version 32</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/33">version 33</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.51.0">version 140.0.7339.51.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090300">2025090300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090300">2025090300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025090200 release:</p><ul><li>Sandboxed Google Play compatibility layer: add stub for Debug.dumpService("media_projection") to fix a recent regression caused by a Google Play Store behavior change yesterday which was breaking using the Play Integrity API and therefore slightly reducing app compatibility</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025090200">2025090200</a></h3><p>This is an early September security update release based on the September 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025090200">2025090200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025081400 release:</p><ul><li>full 2025-09-01 security patch level</li><li>add support for address lines in the GrapheneOS geocoder implementation</li><li>Dialer: fix visual voicemail with Verizon MVNOs by working around AOSP Dialer not supporting vvm_type_vvm3_mvno</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.148</li><li>kernel (6.1): reapply minor f2fs change we previously reverted due to it causing a regression since the stock Pixel OS has shipped it a while ago so the regression must have been fixed by other changes</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.102</li><li>kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.42</li><li>adevtool: massive overhaul to improve our infrastructure for device support</li><li>adevtool: add command for extracting aconfig flag values from device images</li><li>adevtool: add command for decompiling APKs and JARs from device images and creating an IntelliJ project from it</li><li>adevtool: detect missing vendor regeneration after adevtool changes</li><li>adevtool: parallelize state regeneration and remove unnecessary data from serialized build state files</li><li>Theme Picker: use AOSP launcher name for fetching resources in preparation for Android 16 QPR1 requiring this to be set up properly</li><li>Settings: prepare PIN scrambling setting for the upcoming port to Android 16 QPR1</li><li>Seedvault: update to 16-5.7 (there are no changes to the code compared to the Android 16 development revision we previously shipped, only translation changes)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-161">version 161</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.158.0">version 139.0.7258.158.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/140.0.7339.35.0">version 140.0.7339.35.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/87">version 87</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/88">version 88</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/31">version 31</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/31">version 31</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025081400">2025081400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025081400">2025081400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025081300 release:</p><ul><li>temporarily revert extended fix for upstream MediaMetadata bug due to it causing a regression and needing to be adjusted</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/86">version 86</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025081300">2025081300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025081300">2025081300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025080600 release:</p><ul><li>limit MediaMetadata object size to avoid Binder failures to resolve the rest of an upstream Android denial of service issue triggered in real world use by LibreTube (this extends our previous fix in our <a href="https://grapheneos.org/releases#2025072700">2025072700</a> release)</li><li>reduce time update threshold to 50ms from Android's default 2000ms instead of allowing the clock to get up to 2s out-of-date (this change was lost during one of the major release ports when Android significantly changed the code and moved where this is configured)</li><li>Pixel 8a: fix inclusion of PSDS overlay since our port to Android 16 which was breaking using our PSDS proxy until we worked around it server-side with a redirect from broadcom.psds.grapheneos.org to samsung.psds.grapheneos.org for the Samsung PSDS download path</li><li>Samsung GNSS devices (Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a): switch to TLSv1.3-only for SUPL instead of TLSv1.2-only now that it's supported by gnssd</li><li>change User-Agent for geocoder to "GrapheneOS geocoder $USER_AGENT_VERSION" where the version is currently 1 and can be incremented if there are significant changes to how we make requests (this was previously using the default Android User-Agent sending more information than necessary)</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.101</li><li>Seedvault: update to latest revision for Android 16 (will be replaced with a better backup implementation in the future)</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/84">version 84</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/85">version 85</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/6">version 6</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.123.0">version 139.0.7258.123.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025080600">2025080600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025080600">2025080600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025080400 release:</p><ul><li>full 2025-08-05 security patch level</li><li>apply the only change not related to the Pixel 6a battery workaround from the August 2025 Pixel kernel drivers obtained via GPL source request</li><li>update to August 2025 Pixel vendor/firmware code</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/12">version 12</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025080400">2025080400</a></h3><p>This is an early August security update release based on the August 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Android Security Bulletin tags have not yet been pushed to the Android Open Source Project this month but we've had access to the signed partner bulletin zip with the same patches for a month. There are only 3 patches in the August 2025-08-01 bulletin and one of those doesn't impact Android 16. Of the 2 marked as impacting Android 16, the critical severity issue was already fixed in the initial Android 16 release. Therefore, there's only a single High severity patch to Android 16 for the Android Open Source Project for August.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025080400">2025080400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025073000 release:</p><ul><li>full 2025-08-01 security patch level</li><li>add opt-in service for geocoding (translating location names to coordinates) and reverse geocoding (translating coordinations to location names) with the option of either a GrapheneOS proxy to Nomanatim or direct use of Nominatim which will improve compatibility with a tiny subset of apps depending on the OS providing this without an alternative (the service is open source with open data so our proxy is temporary and will be replaced with a self-hosted service, but we need to determine if we want to use Nominatim or Photon along with dealing with the high hardware requirements far beyond what our current network servers can provide)</li><li>add a workaround for bug in sonycast.sdk.ScMediaRouteProvider used by Tidal and other apps causing occasional NsdService related crashes in combination with VPN lockdown due to us fixing NsdService related VPN leaks</li><li>override pseudo locales with their respective base locales in the Android Runtime since they're currently broken and break using the device (we already disabled enabling pseudo locales in the previous release but a couple users enabled this developer option and need a release fixing it to use their device)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.147</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.100</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.62.0">version 139.0.7258.62.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/139.0.7258.62.1">version 139.0.7258.62.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025073000">2025073000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025073000">2025073000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025072800 release:</p><ul><li>extend our workaround for the upstream Android asynchronous dexopt optimization issue to handle original-package package renaming which we used to rename Vanadium's package name from org.chromium.chrome to app.vanadium.browser years ago and users on 6th gen Pixels with installs prior to it could have a crash caused by our fix for the upstream issue</li><li>add a temporary workaround for AOSP Dialer still using a legacy approach to notifications which interacts badly with notification grouping</li><li>remove support for switching to a pseudo-locale when developer options are enabled since it can cause major issues</li><li>Sandboxed Google Play compatibility layer: add stub for BluetoothDevice.getBondState() to avoid Android Auto crash</li><li>Settings: fix upstream Android null pointer exception in UserAspectRatioDetails.launchApplication()</li><li>System Updater: update minimum and target API level to 36 (Android 16)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025072800">2025072800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025072800">2025072800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025072700 release:</p><ul><li>add missing multi-user handling to the package information query used by both of the new VPN leak protections which was discovered during Alpha channel testing from app crashes in secondary users for apps not installed in the Owner user</li><li>fix implementation of INsdServiceConnector stub used as part of our NsdService#connect VPN leak protection to avoid an edge case resulting in app crashes found during Alpha channel testing</li><li>include additional overlays from the stock Pixel OS for Settings animations and Settings/SystemUI strings mostly related to documentation</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025072700">2025072700</a></h3><p>This release resolves 2 upstream Android VPN leaks discovered by GrapheneOS and our community testers. We aren't aware of any other outbound Android VPN leaks when Private DNS is set to Off. Android's Private DNS feature needs a significant overhaul for how it works with secondary profiles and VPNs.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025072700">2025072700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025071900 release:</p><ul><li>prevent using SO_BINDTODEVICE to bypass VPN lockdown mode (leak protection) to resolve an upstream Android VPN leak discovered by GrapheneOS testers where code specifies a specific interface via a special system call to bypass the VPN</li><li>prevent using NsdService#connect for components restricted by VPN lockdown mode to prevent a very limited upstream Android local network VPN leak discovered by GrapheneOS</li><li>add workaround for upstream Android asynchronous dexopt bug causing concurrent installs of the same package to be handled incorrectly which then causes crashes when attempting to uninstall</li><li>temporarily disable asynchronous pre-reboot OS update app optimization (dexopt) added in Android 16 to avoid the Finalizing step completing before apps are recompiled which can then result in it causing a very long initial boot of the new OS version if the user reboots before the background app optimization completes (this will not apply to updating to this release but rather only updating to future releases from this one and onwards)</li><li>MediaMetadata: fix upstream Android bug by using shared bitmaps to avoid serialized metadata going beyond the Binder transaction size limit and causing system service failures including Bluetooth service crashes (this issue existed prior to Android 16)</li><li>Sandboxed Google Play compatibility layer: revert change for dropping phenotype flag overrides before applying new ones since it can cause flag values to be set inconsistently due to a race</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.146</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.99</li><li>AppCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_AppCompatConfig/releases/tag/4">version 4</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-160">version 160</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.168.0">version 138.0.7204.168.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.168.1">version 138.0.7204.168.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025071900">2025071900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025071900">2025071900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070800 release:</p><ul><li>Dialer: always show scrollbar for button grid when there are more than 6 buttons to make it clear it can be scrolled</li><li>Dialer: move RTT button to the end since it's rarely used</li><li>Network Location: improve position estimation implementation to provide better performance, accuracy and stability</li><li>Network Location: add support for detecting location based on cell towers when Wi-Fi-based location can't obtain any position estimate</li><li>add back "Prevent ringing" gesture via Power + Volume Up which was lost in the port to Android 16</li><li>Settings: fix discharge time estimates not being shown when charging optimization (charging limit) enabled</li><li>Settings: avoid explanation in per-app Play Integrity API settings being cut off</li><li>fully prevent empty end session button being shown</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.145</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.98</li><li>include more color overlays from the stock Pixel OS</li><li>add back desktop mode toggle to developer options which was missing due to Android 16 requiring enabling config_isDesktopModeDevOptionSupported in addition to the config_isDesktopModeSupported feature we were already enabling</li><li>adevtool: add infrastructure for defining synthetic overlays and migrate to using it (automates more of device support and results in the battery charging limit text being updated)</li><li>adevtool: heavily optimize state collection by only calculating what gets built instead of building it</li><li>enable optimization of pausing wallpaper rendering for Pixel Camera</li><li>Terminal (virtual machine management app): temporarily disable GUI support until Android 16 regression causing surfaceflinger crash is resolved</li><li>Seedvault: update to 15-5.6 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.157.0">version 138.0.7204.157.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-159">version 159</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070800">2025070800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070800">2025070800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070700 release:</p><ul><li>update to BP2A.250705.008 vendor files (July 2025 Pixel monthly release)</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed since releasing our port to Android 16 (users can enable this themselves via Settings &gt; Security and privacy &gt; More security and privacy &gt; Notify about system process crashes)</li><li>NFC: always show standard confirmation dialog before opening a URL instead of it only being enabled for a small subset of users</li><li>temporarily remove NFC auto-turn-off feature since it can cause NFC HAL or system_server crashes in rare edge cases and we need to entirely reimplement it inside of the NFC APEX module to avoid the problems (there were rare issues reported prior to Android 16 but 1 user reported an NFC HAL crash loop on Android 16 making it clear we need to drop this until we redo it in a better way)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070700">2025070700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070700">2025070700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070600 release:</p><ul><li>raise security patch level to 2025-07-05 since it's already provided without applying any additional patches</li><li>only permit third party apps to use custom activity animations for transitions between their own activities to prevent a recently disclosed <a href="https://taptrap.click/">Android tapjacking vulnerability branded as TapTrap</a></li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: fix regression breaking DisplayPort alternate mode in the previous release</li><li>Sandboxed Google Play compatibility layer: fix phenotype flag overrides not working on production builds which regressed quite a while ago and limited our ability to fix certain compatibility issues via quick GmsCompatConfig updates</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070600">2025070600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070600">2025070600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070500 release:</p><ul><li>backport fix for back button regression in Android 16 from Android 16 QPR1 Beta 2.1</li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: restore using asymmetric MTE mode for userspace instead of the default asynchronous mode</li><li>add back switching to using the Natural display color mode by default</li><li>migrate more device support to adevtool and remove more unused configuration</li><li>improve per-device integration for USB-C port control and pogo pins control to make maintenance easier</li><li>adevtool: remove obsolete overlay handling implementation</li><li>remove Circle to Search feature declaration</li><li>enable Runtime Resource Overlay (RRO) enforcement</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070500">2025070500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070500">2025070500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070301 release:</p><ul><li>partially revert upstream changes in Android 16 breaking parts of the lockscreen layout including the date and media info</li><li>Pixel 8 Pro, Pixel 9 Pro, Pixel 9 Pro XL: add back feature declaration for Pixel Thermometer support lost in our Android 16 device port migration which prevented fresh installs of the app</li><li>Terminal (virtual machine management app): disable VM console feature since it isn't supported by the stable release of Android 16 outside of debug builds and trying to use it breaks installing the new images (the feature can be enabled once the core OS supports it in production builds)</li><li>update Pixel HAL compatibility matrix version numbers for Android 16</li><li>add lockscreen synchronization failsafe to protect against unknown vulnerabilities</li><li>improve code quality and add unit tests for our strict CVE-2024-50089 protection</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.94</li><li>fix port of our 2-factor fingerprint authentication tests to Android 16</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070301">2025070301</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070301">2025070301</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070300 release:</p><ul><li>fix upstream Android 16 issue causing very large Binder transactions due to the size scaling based on the number of apps installed across all users including base OS apps</li><li>reduce virtual memory reserved for Binder buffers back to 1MiB now that we have a direct fix for the upstream issue causing more to be required and using a larger virtual memory reservation size appears to have a small chance of failing</li><li>revert our fix for a screenshot process crash that's now fixed upstream in Android 16</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070300">2025070300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070300">2025070300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025070100 release:</p><ul><li>increase virtual memory reserved for Binder buffers from 1MiB to 8MiB due to Android 16 having a very large Binder transaction scaling up based on the number of apps and profiles which can go beyond the total size limit and break fully booting the OS, which occurred for a tiny number of our Alpha testers (if you were one of the tiny number of Alpha channel testers running into this, you can <a href="https://grapheneos.org/updates#sideloading">sideload this release</a> to resolve the issue)</li><li>fix issues with display of the end session button to avoid it being wrongly displayed for Owner or not displayed for secondary users (we may remove this part of the upstream end session UI or make it optional since the functionality is also in the power menu)</li><li>update Pixel USB HAL to Android 16 (this was omitted in the initial port due to needing special handling for our USB-C port and pogo pins control feature)</li><li>always use UTC as the time zone for build date properties</li><li>kernel (6.6): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025070100">2025070100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025070100">2025070100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025063000 release:</p><ul><li>Exynos 5400 modem Pixels (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): temporarily disable hardened_malloc and hardware memory tagging for shared_modem_platform executable due to an upstream write-after-free bug</li><li>Launcher: fix upstream bug causing a crash for the interface to add lockscreen widgets (currently a tablet only feature until Android 16 QPR1)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.63.0">version 138.0.7204.63.0</a></li><li>add debug build functionality for toggling off hardened_malloc usage for vendor processes to make narrowing down issues quicker</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025063000">2025063000</a></h3><p>This is the initial official release of GrapheneOS based on Android 16 after the June 10th release of Android 16. Device support for Pixels was removed from the Android Open Source Project for Android 16 and had to be reimplemented which is why it took so much longer than usual. Please join our <a href="https://grapheneos.org/contact#community-chat">testing chat room</a> if you're interesting in testing this experimental release. We'll be making a series of releases this week to fix several known issues and other issues.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025063000">2025063000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)</li></ul><p>Changes since the 2025062700 release:</p><ul><li>full Android 16 port with all GrapheneOS features available (we previously shipped some parts of Android 16 backported to Android 15 QPR2 to provide the 2025-06-05 and then 2025-07-01 Pixel patch level)</li><li>migrate to using adevtool to handle a much larger portion of device support since the Android Open Source Project no longer includes device support for Pixels</li><li>adevtool: add new arcslib infrastructure for extracting resource overlays from the stock Pixel OS</li><li>adevtool: use fixed build number and build date for state regeneration to reduce diffs</li><li>don't disable external ports at boot on debug builds for internal development for debugging early boot failures</li><li>temporarily enable system crash notifications unconditionally for early Android 16 testing</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025062700">2025062700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025062700">2025062700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025062000 release:</p><ul><li>raise security patch level to 2025-07-01 since it's already provided without applying any additional patches</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Pixel 6, Pixel 6 Pro, Pixel 6a: remove AOSP configuration marking android.hardware.location.network as unavailable since it has meant to be declared available since our <a href="https://grapheneos.org/releases#2023062300">2023062300 release</a> adding emulated network location and we also have our own opt-in network location implementation since our <a href="https://grapheneos.org/releases#2025022700">2025022700 release</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.35.0">version 138.0.7204.35.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.0">version 138.0.7204.45.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.1">version 138.0.7204.45.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/138.0.7204.45.2">version 138.0.7204.45.2</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025062000">2025062000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025062000">2025062000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061900 release:</p><ul><li>fix an issue with our added infrastructure for overriding the minimum SDK version for APK-based components backported from Android 16 (Samsung Shannon IMS/RCS was not active resulting in VoLTE, VoNR, VoWi-Fi, SMS via LTE/NR/Wi-Fi and RCS not working so the 2025061900 release was quickly cancelled before being rolled out to a large number of Alpha channel users)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061900">2025061900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061900">2025061900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061600 release:</p><ul><li>full 2025-06-05 Pixel security patch level based on Android 16 backports (full Android 2025-06-05 patch level was provided in an earlier release)</li><li>Pixels: backport Android 16 Wi-Fi firmware, Bluetooth firmware and TPU firmware</li><li>Pixels: backport Android 16 Samsung Radio Interface Layer (RIL) code</li><li>Sandboxed Google Play compatibility layer: fix rare system_server crash reported with Android Auto by adding check for a null calling package</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.115.0">version 137.0.7151.115.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061600">2025061600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061600">2025061600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061500 release:</p><ul><li>partial 2025-06-05 security patch level (Android 2025-06-05 patch level is provided but still only a subset of the Pixel 2025-06-05 patch level due to remaining Android 16 firmware/driver patches being required)</li><li>update to Android 16 kernel drivers and kernel build system to ship the Pixel kernel driver patches from Android 16 while we're still reimplementing device support for Pixels due to AOSP removing it</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061500">2025061500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061500">2025061500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061300 release:</p><ul><li>adjust our hard-wired Android 16 cellular radio version string to pass the case sensitive check done by the install process</li><li>adjust the SUPL disabled mode to work around Samsung gnssd (Pixel 8a and all 9th gen Pixels) not implementing SUPL_MODE properly (reboot is required for the Off mode to kick in on these devices)</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/11">version 11</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061300">2025061300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061300">2025061300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025061000 release:</p><ul><li>update SoC and cellular radio firmware to the Android 16 releases to ship the security patches prior to our Android 16 port</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.89.0">version 137.0.7151.89.0</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/10">version 10</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025061000">2025061000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025061000">2025061000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025060200 release:</p><ul><li>expand our code for checking Google Play Store source stamp signatures to checking each split APK in order to prepare it for future security-relevant usage including optionally marking apps as installed from the Play Store after verifying the source stamp (this is currently used for stripping Play Store inserted checks for apps being installed from the Play Store which had looser security requirements)</li><li>remove Chunghwa Telecom and Netlock Certificate Authorities (CAs) based on <a href="https://security.googleblog.com/2025/05/sustaining-digital-certificate-security-chrome-root-store-changes.html">the decision by the Chrome Root Store</a> (this does not impact Vanadium since it uses a more sophisticated browser root store rather than the OS root store and will distrust certificates from these CAs not added to Certificate Transparency logs before 2025-08-01 to avoid website compatibility issues)</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.141</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.72.0">version 137.0.7151.72.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.72.1">version 137.0.7151.72.1</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/9">version 9</a></li><li>Network Location: increase difficulty of position estimation tests to help avoid regressions</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025060200">2025060200</a></h3><p>This is an early June security update release based on the June 2025 security patch backports since the yearly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025060200">2025060200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025060100 release:</p><ul><li>full 2025-06-01 security patch level</li><li>System Updater: temporarily revert notification protection due to upstream Android UI issues for this feature with privileged apps (we still plan to do this but it will need to wait until we resolve the OS issue)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025060100">2025060100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025060100">2025060100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025052800 release:</p><ul><li>Media Provider: expand our existing protection against CVE-2024-50089 which is still not addressed upstream (we added generic hardening in 2022 as a prerequisite for Storage Scopes which along with fixing information leaks still unfixed upstream blocked exploiting CVE-2024-50089 for the common cases of not granting permissions, granting media permissions or using our Storage Scopes feature but we didn't fully cover "All files access" or the legacy API level equivalent when not using Storage Scopes)</li><li>System Updater: prevent disabling overall notifications due to lack of a use case and many users doing it by accident, but continue allowing disabling the individual notification channels other than the reboot notification</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.92</li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/8">version 8</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.61.0">version 137.0.7151.61.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025052800">2025052800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025052800">2025052800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025052000 release:</p><ul><li>disable anti-competitive code being injected by the Play Store into apps choosing to enable "App integrity &gt; Automatic protection" when there's a valid Play Store source stamp signature (proving that it's an unmodified app from the Play Store, so we aren't disabling an integrity check) since it prevents using the apps on GrapheneOS when apps also choose to enable "App integrity &gt; Store listing visibility" with either the "Device integrity checks" or "Strong integrity checks" values enforcing having a device licensing Google Mobile Services and running the stock OS (circumventing this is protected by the DMCA exemption for jailbreaking)</li><li>Private Space: fix further issues with quiet/locking state changes in secondary users</li><li>extend NFC auto-turn-off to work when logged into a secondary user</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.140</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.44.0">version 137.0.7151.44.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/137.0.7151.44.1">version 137.0.7151.44.1</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025052000">2025052000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025052000">2025052000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025051900 release:</p><ul><li>Private Space: set correct state on user start or stop for secondary users</li><li>Private Space: make sure nested profiles in secondary users have their storage put at rest when the parent profile's session is ended</li><li>Keyboard: remove dedicated language switch key from the phone layout since it's already shown by the OS itself and uses up too much space with the emoji key already next to the space bar</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025051900">2025051900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025051900">2025051900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050700 release:</p><ul><li>add NFC auto-turn-off setting to go along with the existing addition of Wi-Fi and Bluetooth auto-turn-off settings</li><li>Private Space: add new setting for disabling delayed locking of storage to make locking work like secondary user end session feature we enable, similar to the toggle we add for disabling secondary users running in the background (standard Private Space doesn't work this way to keep fingerprint unlock available after it's locked/stopped)</li><li>Private Space: add new setting for blocking sharing the clipboard to and/or from the parent profile and other nested profiles within it</li><li>Private Space: add support for the Install available apps feature we currently enable to support installing apps available in the Owner user to secondary users</li><li>Private Space: add support for secondary users including all standard features with the exception of auto-locking support since our implementation of that is too complex/invasive to properly review and test while we're focused on Android 16 porting</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.138</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.89</li><li>Keyboard: move the emoji key to the left of the space bar for the phone layout instead of putting it behind a long press or replacing the enter key with it when put into the emoji mode by apps like AOSP Messaging</li><li>Keyboard: stop replacing the emoji key with the .com key for the email and URL input types</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.125.0">version 136.0.7103.125.0</a></li><li>add support for testing Android 16 Beta 4.1 feature flags for development builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050700">2025050700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050700">2025050700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050500 release:</p><ul><li>full 2025-05-05 security patch level</li><li>rebased onto BP1A.250505.005.D1 Android Open Source Project release</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.87.0">version 136.0.7103.87.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050500">2025050500</a></h3><p>This is an early May security update release based on the May 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050500">2025050500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025050300 release:</p><ul><li>full 2025-05-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025050300">2025050300</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025050300">2025050300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025042500 release:</p><ul><li>extend security state manager service to support the official Auditor release (based on the signing key) obtaining additional security state (currently the configuration for auto-reboot, USB-C port and pogo pins control, OEM unlocking and user count)</li><li>Auditor: add default enabled data saver exemption</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to synchronous mode for the Hardware Tag-Based KASAN implementation to improve security and error reporting (we'll continue using asymmetric mode in userspace where it provides very comparable security and error reporting to synchronous mode with lower overhead)</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.1): revert upstream Linux kernel change attempting to work around frame drops caused by a workaround used by video players on X11-based platforms (irrelevant to Android) due to it breaking DisplayPort alternate mode audio</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.88</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/89">version 89</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/29">version 29</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/30">version 30</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.60.0">version 136.0.7103.60.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-157">version 157</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-158">version 158</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025042500">2025042500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025042500">2025042500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025041100 release:</p><ul><li>Bluetooth: backport upstream fixes for compatibility with certain Bluetooth peripherals caused by a recent security fix for Bluetooth encryption</li><li>avoid granting special runtime permissions (Network, Sensors) added by GrapheneOS when unarchiving an app</li><li>use our restricted setting infrastructure to restrict system app access to our notification forwarding setting too</li><li>Settings: prevent disabling system Dialer app since it's always required for emergency calls</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.134</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.87</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.100.0">version 135.0.7049.100.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.111.0">version 135.0.7049.111.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/136.0.7103.44.0">version 136.0.7103.44.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025041100">2025041100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025041100">2025041100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025040700 release:</p><ul><li>full 2025-04-05 security patch level</li><li>rebased onto BP1A.250405.007.D1 Android Open Source Project release</li><li>remove code for Qualcomm XTRA (PSDS) privacy improvements since we no longer have any devices with Qualcomm GNSS and we can add it back in the future if we need it again rather than porting it forward under the assumption we'll be using it</li><li>fix upstream RecoverySystem.verifyPackage(...) vulnerability (this was not directly exploitable due to there being 2 layers of update package signature verification and downgrade protection, but the first layer of protection should work properly to avoid a vulnerability in the 2nd layer being exploited)</li><li>Android Debug Bridge: more complete fix for upstream use-after-free bug for network-based connections which is being caught by our always enabled hardware memory tagging support for the base OS in hardened_malloc</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.83</li><li>Seedvault: update to 15-5.5 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.79.0">version 135.0.7049.79.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/88">version 88</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/27">version 27</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/28">version 28</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025040700">2025040700</a></h3><p>This is an early April security update release based on the April 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025040700">2025040700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025040400 release:</p><ul><li>full 2025-04-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025040400">2025040400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025040400">2025040400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025032500 release:</p><ul><li>Sandboxed Google Play compatibility layer: remove StatsManager from hidden services and replace that approach with stubbing out all of the methods since Play services recently introduced new code using it that's missing a null check and triggers a null pointer exception which has blocked us from pushing out the newer versions of Play services beyond our App Store's Alpha channel</li><li>Network Location: switch to making at most a single request to the service per position estimation by requesting up to 40 Wi-Fi APs at once</li><li>Network Location: optimize making requests to the service for Wi-Fi AP data</li><li>Network Location: optimize Rust JNI bindings to the point that it no longer causes a noticeable overhead without introducing unsafe code (it could be optimized further with unsafe code to cache more JNI binding work but the difference is insignificant so we don't plan to do it)</li><li>Network Location: use correct Accept header value to more closely match macOS to avoid future compatibility issues</li><li>fix upstream system_server crash from null pointer exception in F2fsUtils</li><li>add infrastructure for more restricted access to global and per-user settings instead of allowing all system apps to read them and all privileged systems apps with the WRITE_SECURE_SETTINGS privileged permission to write them</li><li>further restrict access to all global and per-user settings added by GrapheneOS with our new infrastructure</li><li>replace disabling the unused ADD_USERS_WHEN_LOCKED and ENABLE_EPHEMERAL_FEATURE settings at boot with a new approach of making settings immutable in the code, which we can expand in the future to other problematic settings not used by GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.131</li><li>kernel (6.1): drop revert for upstream USB fix causing DisplayPort alternate mode regression due to another upstream patch successfully fixing it</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.38.0">version 135.0.7049.38.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-155">version 155</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-156">version 156</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025032500">2025032500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025032500">2025032500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025032100 release:</p><ul><li>Network Location: rewrite position estimation in Rust (from Kotlin) with a new algorithm based on Expectation-Maximization (EM) always using 3D (altitude) to provide much better accuracy, robustness and performance (this new 3D implementation performs better than the previous implementation in the 2D mode we were stuck using due to 3D being far too CPU intensive)</li><li>Network Location: improve RSSI-based (signal strength) distance estimation including tuning it separately for 2.4GHz vs. 5GHz/6GHz and take distance variance into account for position estimation (Wi-Fi Round-Trip-Time support will be added in the future for Access Points supporting it)</li><li>Network Location: add support for 6GHz Wi-Fi networks via Reduced Neighbor Report (RNR)</li><li>Network Location: increase the number of closest APs we explicitly request data for from 5 to 15</li><li>Network Location: request data for up to 4 APs at a time instead of only 1 to improve networking efficiency</li><li>Network Location: make our requests more closely match a current macOS release to avoid future compatibility issues and to get Apple's service to provide more than only 2.4GHz networks as nearby networks in response to queries</li><li>Network Location: reduce requesting data for 100 additional nearby Wi-Fi APs down to 8 APs when a decent amount of additional results were returned from a recent request for up to 100 in the past 10 seconds</li><li>backport upstream brightness fluctuation fix from Android 16 Beta 3.1</li><li>Sandboxed Google Play compatibility layer: fix Location Accuracy link with Play services 25.09 and later so we can ship it as an update for users with sandboxed Google Play installed</li><li>Sandboxed Google Play compatibility layer: remove no longer supported "Configure Play Store updates" settings since we always handle updates ourselves via our App Store now</li><li>fix an upstream screenshot process crash in ScrollCaptureController</li><li>Terminal (virtual machine management app): backport upstream improvements including detecting an outdated image to providing an upgrade path and removing the artificial cap on disk resize</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.135.0">version 134.0.6998.135.0</a></li><li>only block installing out-of-band APEX updates on production (user) builds since it's useful for development</li><li>add support for testing Android 16 Beta 3 feature flags for development builds</li><li>begin porting our changes to work with Android 16 feature flags</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025032100">2025032100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025032100">2025032100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025031400 release:</p><ul><li>Sandboxed Google Play compatibility layer: improve support for overriding Gservices flags to avoid situations where our overrides aren't used leading to compatibility issues (this should fix a recent Play services crash that's being reported)</li><li>Sandboxed Google Play compatibility layer: improve support for overriding phenotype flags and fix flag overrides not being applied in some cases</li><li>fix 2 upstream lockscreen layout bugs with split shade used on folding phones (for the inner screen) and tablets</li><li>fix upstream lockscreen layout bug with placement of alarm and Do Not Disturb information</li><li>fix upstream lockscreen layout bug hiding date text when media is playing</li><li>enable support for the new desktop mode as an additional developer option toggle (Pixel Tablet already has this as the main toggle)</li><li>Terminal (virtual machine management app): backport upstream improvements</li><li>System Updater: raise download buffer size</li><li>System Updater: delete update package immediately after completion</li><li>System Updater: fall back to downloading and installing a full update if an incremental (delta) update fails initialization which occurs when a firmware or OS image has been corrupted (extremely rare edge case due to verified boot)</li><li>System Updater: retry faster if installation fails</li><li>System Updater: improve error checking to provide better error messages</li><li>System Updater: close update package zip file earlier</li><li>Network Location: require TLSv1.3 for GrapheneOS services instead of either TLSv1.2 or TLSv1.3</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Seedvault: update to 15-5.4 (will be replaced with a better backup implementation in the future)</li><li>stop disabling inclusion of device diagnostics functionality now that it's available in the Android Open Source Project</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.108.0">version 134.0.6998.108.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025031400">2025031400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025031400">2025031400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025031300 release:</p><ul><li>Sandboxed Google Play compatibility layer: add back default values to the API definitions for our reimplementation of the Google Play location service since dropping them in the previous release (2025031300) broke compatibility with a subset of apps and prevented us moving it past our Alpha channel (all the improvements from the previous release are still present)</li><li>adevtool: fix support for checking stock OS kernel revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025031300">2025031300</a></h3><p>This release greatly improves the experimental virtual machine management app with many backports from the Android Open Source Project main branch. You'll need to install Android's latest Debian-based image in order to continue using it. You'll be prompted to do this at startup after it fails to start with the old setup with an opportunity to back up the data. The data inside it should continue to be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025031300">2025031300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030900 release:</p><ul><li>Sandboxed Google Play compatibility layer: overhaul our default enabled reimplementation of the Google Play location service (location request rerouting) to provide much better compatibility for apps depending on network-based location by always telling apps that the Google Improve Location Accuracy toggle is enabled and providing fallback to GNSS for low power location requests when the OS network location service is disabled as it is by default (unlike Google Play services, which has no fallback, but apps assume users enable the feature)</li><li>fix Storage Scopes related null pointer exception in the permissions manager</li><li>Bluetooth: backport fix for empty adapter name handling in Android 15 QPR2 to avoid crashes when the name is set to an empty value or whitespace</li><li>Terminal (virtual machine management app): backport a large set of improvements including terminal tabs, working port forwarding, GUI support with opt-in GPU hardware acceleration (ANGLE-based VirGL until GPU virtualization support is available), speaker/microphone support and fixes for a bunch of bugs including overly aggressive timeouts</li><li>Settings: add Terminal app toggle to System category when developer options are enabled (requirement will be dropped when it's no longer experimental) so it can be enabled in other users (it's still currently only possible to use 1 instance at a time due to conflicting use of an internal network specific to virtual machine management)</li><li>Pixel 8 Pro, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix support for enabling UWB (ultra wideband) radio by adding missing SELinux policy to avoid the UWB service chain crashing and burning CPU</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.130</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.82</li><li>Seedvault: update to 15-5.3 (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.95.0">version 134.0.6998.95.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/83">version 83</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030900">2025030900</a></h3><p>This release adds support for the experimental virtual machine management app introduced in Android 15 QPR2. It currently only provides support for managing a single VM and interacting with it via a WebView-based terminal. Android is in the process of adding support for graphics and GPU acceleration for a future release. For now, it's only available in developer options due to being highly experimental. We don't recommend using developer options on a production device, but you can temporarily enable it to turn on this feature and turn them back off without it being disabled like most developer options. The data inside it should currently be treated as disposable rather than relying on it not losing it from a bug or a backwards incompatible update. We plan to support choosing other guest operating systems beyond the Debian-based image provided by Android along with taking far more advantage of the virtualization infrastructure.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030900">2025030900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030800 release:</p><ul><li>SystemUI: re-enable migrate_clocks_to_blueprint and communal_hub flags with workarounds for upstream issues when using standard AOSP UI components instead of Pixel OS components</li><li>Android Debug Bridge: fix upstream crash caused by a race condition that sometimes unregistered a closed file descriptor from epoll</li><li>Sandboxed Google Play compatibility layer: fix issue breaking RPC transactions which impacts the Terminal app</li><li>Sandboxed Google Play compatibility layer: add implementation of isGoogleLocationAccuracyEnabled() to the location rerouting implementation always returning true to fix compatibility with apps checking for it</li><li>Sandboxed Google Play compatibility layer: fix definition of IStatusCallback.onCompletion() to slightly improve performance</li><li>allow Terminal app to use WebView JIT since it requires WebAssembly</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.80</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030800">2025030800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030800">2025030800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030700 release:</p><ul><li>SystemUI: temporarily disable migrate_clocks_to_blueprint and communal_hub flags again to avoid upstream Android 15 QPR1 lockscreen layout regressions which are still present in Android 15 QPR2 until we resolve them, which will be prioritized now</li><li>SystemUI: make screenshot sound use sound effects setting again (our change stopped working from the Android 15 QPR2 port)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030700">2025030700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030700">2025030700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030500 release:</p><ul><li>Wallpaper Picker: backport upstream fix for an Android 15 QPR2 bug causing the UI for picking the wallpaper to be blank</li><li>fix upstream system_server crash introduced in Android 15 QPR2 related to Bluetooth telephony integration</li><li>backport upstream fixes for 13 different system_server null pointer exception crashes, an array out of bounds system_server exception and an NFC resolver activity null pointer exception</li><li>backport upstream fix for voice volume adjustments in certain apps</li><li>adevtool (Pixel Tablet): remove unintentional deviation from standard memory pinning configuration</li><li>adevtool: remove unnecessary PersistentBackgroundServices app</li><li>adevtool: filter out config_pluginAllowlist SystemUI overlay to avoid breaking the clock layout by referring to non-AOSP SystemUI clocks</li><li>Sandboxed Google Play compatibility layer: fix Google Play Services for AR not being installable from the Play Store anymore</li><li>Sandboxed Google Play compatibility layer: fix development option for installing the Pixel Thermometer (Pixel Health) app</li><li>add inet group for vmnic (virtual machine networking functionality) to make it compatible with our group-based Network permission enforcement used as another layer of security</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/82">version 82</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030500">2025030500</a></h3><p>This release is based on Android 15 QPR2, the second quarterly release of Android 15. All of the supported devices are now using the Linux 6.1 LTS branch so the 5.10 and 5.15 branches are retired for GrapheneOS. 6.6 continues to be used for microdroid virtual machines on devices and for emulator builds, which will likely move to 6.12 this year.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030500">2025030500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030300 release:</p><ul><li>full 2025-03-05 security patch level</li><li>rebased onto BP1A.250305.020.T2 Android Open Source Project release (initial Android 15 QPR2 release)</li><li>Settings: replace our approach to making the Unrestricted battery mode more visible due to changes in Android 15 QPR2</li><li>drop 8 downstream GrapheneOS patches for upstream Android bugs which should no longer be required due to upstream fixes in Android 15 QPR2</li><li>kernel (Pixel 7a): temporarily disable RANDSTRUCT due to a Qualcomm Wi-Fi driver incompatibility (only the Pixel 7a uses Qualcomm Wi-Fi and RANDSTRUCT wasn't enabled before Android 15 QPR2 for 6th/7th/8th gen Pixels since they weren't on 6.1 yet)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030300">2025030300</a></h3><p>This is an early March security update release based on the March 2025 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR2) scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030300">2025030300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030200 release:</p><ul><li>full 2025-03-01 security patch level</li><li>Network Location: temporarily disable using altitude in trilateration for now because 3D trilateration is using an excessive amount of CPU time and we need to greatly optimize it with algorithm level improvements, porting it to Rust and other optimizations before we can use 3D</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/29">version 29</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/30">version 30</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030200">2025030200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030200">2025030200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025030100 release:</p><ul><li>Sandboxed Google Play compatibility layer: remove requestLocationSettingsDialog() implementation due to apps implicitly depending on it behaving in a very specific way</li><li>Sandboxed Google Play compatibility layer: add isHybridLocationServiceEnabled() API</li><li>Sandboxed Google Play compatibility layer: skip redundant location settings check activity when rerouting is on</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025030100">2025030100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025030100">2025030100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025022800 release:</p><ul><li>Network Location: improve integration of altitude into trilateration to properly account for not all networks providing it including avoiding an edge case null pointer exception</li><li>Network Location: add default enabled data saver exemption</li><li>Network Location: use hideFromAppOps as documented by the Android API documentation for a network location service to match how the AOSP satellite-based location services and the Play services location services in the stock OS work (this likely avoids the need for the exemption from the GrapheneOS location indicator but we're keeping that for now to avoid wasting development time determining it)</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025022800">2025022800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025022800">2025022800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025022700 release:</p><ul><li>restrict "5G only" mode to carriers with 5G standalone support to avoid setting the option silently failing</li><li>fix ancient upstream bug causing system_server crashes when flushing an inactive location provider which was uncovered by us adding our own network location provider</li><li>exclude network location provider from the GrapheneOS location indicator since it's meant to be shown for apps requesting location rather than showing users when the OS location services listen for GNSS satellite broadcasts and scan nearby networks</li><li>Sandboxed Google Play compatibility layer: fix issues in our requestLocationSettingsDialog() implementation which were uncovered by providing our own network location provider (this is part of our reimplementation of the Google Play location service used when rerouting Google Play location requests to the OS is enabled which is the default)</li><li>Network Location: add built-in battery optimization exception to avoid being blocked from accessing the network from the background in some cases</li><li>Network Location: incorporate altitude into trilateration when available to replace basic altitude support based on averages which wasn't taken into account for the latitude/longitude estimation (i.e. it now operates in 3D instead of 2D)</li><li>Network Location: add TLS key pinning for gs-loc.apple.grapheneos.org</li><li>kernel (6.6): update to latest GKI LTS branch revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025022700">2025022700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025022700">2025022700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025021100 release:</p><ul><li>add opt-in GrapheneOS network location implementation available via Settings &gt; Location &gt; Location services based on using the Apple Wi-Fi positioning API either through a GrapheneOS proxy or directly via Apple's service, which will be extended with much more functionality in the near future including incorporating altitude into trilateration, using cell towers if it provides a better estimate than Wi-Fi and using our own network location database either via a service or offline database downloads (we're in the process of building our own database initially based on collecting most of the data from Apple's service and have already done a test run obtaining essentially all the cell tower data along with lots of Wi-Fi data)</li><li>fix Wi-Fi APEX issues preventing an OS network location service from doing Wi-Fi scans without the INTERACT_ACROSS_USERS / INTERACT_ACROSS_USERS_FULL privileged permissions</li><li>Sandboxed Google Play compatibility layer: add support for using an OS network location provider for the default enabled rerouting of Google Play location requests to the OS location service</li><li>add support for "5G only" and "4G or 5G only" modes in addition to our existing "4G only" mode</li><li>enable support for blocking callers not in Contacts</li><li>resolve regression for secondary user SMS in Android 15 QPR1 by enabling partial upstream fix since we dropped this part of our fix for the issues but the upstream fix wasn't actually active</li><li>fix Storage Scopes / Contact Scopes app settings link not working for apps in nested profiles in some cases</li><li>Launcher: limit 4x5 grid option to phones</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.79</li><li>backport mainline APEX module patches for DocumentsUI, Media Provider and Network Stack</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.89.0">version 133.0.6943.89.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.121.0">version 133.0.6943.121.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.137.0">version 133.0.6943.137.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/134.0.6998.39.0">version 134.0.6998.39.0</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/27">version 27</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/28">version 28</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/5">version 5</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/6">version 6</a></li><li>Messaging: update to <a href="https://github.com/GrapheneOS/Messaging/releases/tag/7">version 7</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/21">version 21</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/22">version 22</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/23">version 23</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/24">version 24</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/25">version 25</a></li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/26">version 26</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/79">version 79</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/80">version 80</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/81">version 81</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025021100">2025021100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025021100">2025021100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020500 release:</p><ul><li>kernel (5.10, 5.15, 6.1, 6.6): zero memory in early boot in case it wasn't zeroed by the OS as part of a clean reboot or shutdown since there isn't fully encrypted RAM with a per-boot key yet (early boot zeroing is implemented by Pixel boot firmware since April 2024 for booting into fastboot mode but not booting into the OS since they only partially implemented our January 2024 reset attack protection proposal, so we need to handle the OS part ourselves)</li><li>kernel (6.1): add back revert for upstream Linux kernel fix which was reapplied in our <a href="https://grapheneos.org/releases#2025020200">2025020200</a> release without any reports of issues for days because it has been found to break DisplayPort alternate mode on 9th generation Pixels</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.128</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.76</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): backport Wi-Fi driver patch from Android 15 QPR2 Beta 3 in an attempt to avoid a rare invalid read-after-free detected by hardware memory tagging</li><li>Launcher: add 4x5 grid option</li><li>remove infrastructure for our legacy software-based USB peripheral blocking since we've replaced it with <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control">a far better feature using both hardware and software USB connection/data blocking</a> across all supported devices</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/78">version 78</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020500">2025020500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020500">2025020500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020300 release:</p><ul><li>full 2025-02-05 security patch level</li><li>rebased onto AP4A.250205.002 Android Open Source Project release</li><li>drop our workaround for upstream audio routing permission bug impacting Android Auto and likely other apps that's no longer required due to an upstream fix in the monthly February release</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to Mali GPU kernel driver from Android 15 QPR2 Beta 3 to include additional security fixes</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.49.0">version 133.0.6943.49.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-154">version 154</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020300">2025020300</a></h3><p>This is an early February security update release based on the February 2025 security patch backports since the monthly Android Open Source Project and stock Pixel OS release scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020300">2025020300</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025020200 release:</p><ul><li>full 2025-02-01 security patch level</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025020200">2025020200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025020200">2025020200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025012700 release:</p><ul><li>reimplement our fix for an upstream audio routing regression in Android 15 QPR1 impacting sandboxed Android Auto and likely other apps to avoid blocking another subset of apps from changing audio routing when granted permission</li><li>Sandboxed Google Play compatibility layer: add support for enabling Google's credential service via Settings &gt; Passwords, passkeys &amp; accounts by making it function as an unprivileged service (non-Chromium-based apps tend to require this to use Google as the passkey service and it's needed by certain apps for their Sign in with Google option despite Android intending to fully support other credential services)</li><li>Sandboxed Google Play compatibility layer: allow disabling all Play Integrity API notifications instead of only disabling them per-app</li><li>Sandboxed Google Play compatibility layer: override Play services update owner value to the GrapheneOS App Store to fully handle updates for it ourselves</li><li>work around upstream Android issue caused by an optimization which was adding a 10 second delay to certain setting changes before they kick in for background system packages</li><li>kernel (5.15): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.126</li><li>kernel (6.1): drop revert for upstream USB fix causing DisplayPort alternate mode regression to test if it's still needed due to lots of other backported changes</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.74</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.39.0">version 133.0.6943.39.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/133.0.6943.39.1">version 133.0.6943.39.1</a></li><li>remove same version ABI stability check not useful for GrapheneOS</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025012700">2025012700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025012700">2025012700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025012600 release:</p><ul><li>fix regression in the previous release for configuring per-app settings added by GrapheneOS for apps in the work profile or Private Space when the Settings app is launched from the Owner user rather than the work profile or Private Space (this was caught during Alpha channel testing and is why it didn't proceed to Beta channel testing)</li><li>avoid Settings app crashing when opening the per-app Play Integrity API menu for an already uninstalled app via a leftover notification</li><li>Sandboxed Google Play compatibility layer: improve Play Integrity API description</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025012600">2025012600</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025012600">2025012600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025011500 release:</p><ul><li>disable standard Android feature holding a 10 minute screen wake lock after the screen brightness is raised at least 2 times within 5 minutes since this is confusing for users and it's far better if keep awake is done explicitly</li><li>always show Linux kernel crash notifications from hardware memory tagging (Hardware Tag-Based KASAN) instead of only when system crash reporting is enabled by users</li><li>Messaging: begin under the hood overhaul including fully porting to target API 35 (Android 15)</li><li>recovery: remove spurious warning after sideloading an update fails on A/B update devices</li><li>change build username and hostname to match the stock Pixel OS format instead of setting both to grapheneos due to bad actors using it to ban using GrapheneOS</li><li>return green as the value of ro.boot.verifiedbootstate for user installed apps (not the base OS or system apps) due to bad actors using it to ban using GrapheneOS</li><li>SettingsIntelligence: don't show preference summaries in search results since it doesn't work properly for ones depending on dynamic string formatting and isn't done by SettingsIntelligenceGoogle on the stock Pixel OS</li><li>Contact Scopes: fix spoofing of OP_GET_CONTACTS for apps not requesting WRITE_CONTACTS</li><li>Sandboxed Google Play compatibility layer: improve infrastructure</li><li>Sandboxed Google Play compatibility layer: allow blocking the Sandboxed Google Play is running notification</li><li>Sandboxed Google Play compatibility layer: add per-app Play Integrity menu in the per-app Settings configuration that's shown after an app uses the Play Integrity API</li><li>Sandboxed Google Play compatibility layer: add per-app toggle for blocking using the Play Integrity API via the per-app Play Integrity menu as a workaround for apps which ban devices based on it but don't require providing it to their service yet</li><li>Sandboxed Google Play compatibility layer: add shortcut to the per-app Play Integrity API menu for contacting the app developer by leaving a review through the Play Store page</li><li>Sandboxed Google Play compatibility layer: add menu for viewing all apps which have used the Play Integrity API with a shortcut in the per-app Play Integrity API menu</li><li>Sandboxed Google Play compatibility layer: show optional notification upon detection of Play Integrity usage providing a shortcut to the per-app Play Integrity API menu and another for hiding further notifications for the app which is also available as a toggle in the per-menu</li><li>hardened_malloc: update libdivide to 5.2.0</li><li>TalkBack (screen reader): update dependencies</li><li>TalkBack (screen reader): make builds fully reproducible by removing the use of __DATE__ and __TIME__ by brltty along with making the liblouis translation table zip use deterministic file order and timestamps</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.124</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.68</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.0">version 132.0.6834.79.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.1">version 132.0.6834.79.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.79.2">version 132.0.6834.79.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/132.0.6834.122.0">version 132.0.6834.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-153">version 153</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025011500">2025011500</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025011500">2025011500</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2025010700 release:</p><ul><li>fix upstream Android lockscreen bug triggered by the combination of fully disabling animations (via Settings &gt; Accessibility &gt; Color and motion &gt; Remove animations) and enabling always-on display (Settings &gt; Display &gt; Lock screen &gt; Always show time and info) which results in the locking process getting stuck and not considering the device locked until it wakes again due to not skipping animations as intended (this did not create a lockscreen bypass but did result in valid biometric unlock credentials skipping restrictions)</li><li>add protection against upstream lockscreen bugs bypassing restrictions on biometric unlocking while the device is asleep including the standard restrictions and our recently added 2-factor fingerprint unlock feature</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): enable hardware memory tagging for the main kernel allocators via the upstream Hardware Tag-Based KASAN implementation (which is intended for production usage, unlike the other KASAN modes)</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch KASAN fault handling from report to panic to use it as a hardening feature instead of only a bug finding tool</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch KASAN hardware memory tagging mode from synchronous to asymmetric for the initial deployment to reduce the performance cost and match our existing hardware memory tagging usage in userspace (synchronous mode is potentially more useful in the kernel than it is for userspace which is something we can investigate and potentially offer as an option)</li><li>kernel (Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): disable our slab canary feature since it's incompatible with the kernel's hardware memory tagging and will be fully obsolete after we've made basic improvements to the upstream hardware memory tagging implementation</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.233</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.176</li><li>kernel (5.15): merge latest GKI tag to incorporate important security and other patches including the patch for CVE-2024-56556 which are not included in the latest kernel.org release (5.15.176) or the latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Updater: require TLSv1.3 instead of either TLSv1.2 or TLSv1.3</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>System UI Tuner: opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bug)</li><li>make eng builds more consistent with user/userdebug builds by extending the GrapheneOS additions of the ro.control_privapp_permissions=enforce, net.tethering.noprovisioning=true and ro.sys.time_detector_update_diff=50 system properties to all build variants</li><li>show a system error notification for privileged permission allowlist violations in development builds (userdebug and eng builds) instead of breaking booting the device to make developing device support and porting to new OS versions easier</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2025010700">2025010700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2025010700">2025010700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024123000 release:</p><ul><li>full 2025-01-05 security patch level</li><li>rebased onto AP4A.250105.002 Android Open Source Project release</li><li>provide standard haptic feedback for fingerprint authentication success when 2nd factor PIN is enabled</li><li>add workaround for upstream SystemServiceManager.newTargetUser null pointer exception bug crashing system_server</li><li>add workaround for upstream BatteryStatsImpl.updateWifiBatteryStats divide by zero bug crashing system_server</li><li>Contacts: improve dark theme contrast for empty contacts list background</li><li>backport mainline APEX module patches for Media Provider, Network Stack and Wi-Fi</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.175</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.123</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.65</li><li>Sandboxed Google Play compatibility layer: fix implementation of getCurrentLocation() to return SUCCESS even when the result is null to avoid some edge case issues</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/76">version 76</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/77">version 77</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.260.0">version 131.0.6778.260.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024123000">2024123000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024123000">2024123000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024121200 release:</p><ul><li>add support for adding a PIN as a 2nd factor to fingerprint unlock to enable our new recommended high threat model configuration of a random diceware passphrase as the primary unlock method and fingerprint+PIN with a random 4-6 digit PIN as the regularly used secondary unlock method (the usual limitations of secondary unlock only being usable for 48 hours after successful primary unlock and our limit of 5 total secondary unlock attempts apply)</li><li>add support for limiting charging the battery to 80% with support for bypass charging similar to the new Android 15 QPR1 stock Pixel OS feature, although unlike the stock Pixel OS our implementation still works while using a secondary user (the limit is currently hard-wired to 80% due to that being what's fully supported for the stock OS usage, but we can eventually make it configurable)</li><li>add support for disabling dynamic code loading via storage for all user installed apps by default as we already do for the dynamic code loading via memory setting instead of only being able to opt-in to the restriction on a per-app basis</li><li>allow dynamic code loading from storage by default for apps depending on Play services due to the legacy dynamite module implementation not yet being fully replaced by split APKs to avoid users encountering a huge number of issues if they disable it by default for user installed apps (users can still disable it for these apps manually and we won't need to keep this exception forever since Google is moving to split APKs for dynamite modules)</li><li>add support for partially recompiling apps (speed-profile) in the Finalizing step of OS updates to skip partially recompiling them during boot, but while still doing most of the work after boot in the background (speed) to avoid slowing down OS update installation too much</li><li>remove adding back boot-time display of app compilation progress now that it's no longer heavily used</li><li>use 2 threads instead of 1 for background compilation of apps</li><li>switch to the new upstream default of 4 threads for compiling apps during boot instead of our previous 2 threads which we set to replace the previous upstream default of a single thread</li><li>Settings: add back battery optimization settings link to Battery screen which was removed by Android a long time ago</li><li>Settings: don't disable App info &gt; Battery usage item while its summary is loading</li><li>Settings: temporarily stop showing battery usage info in App info item summary due to an upstream regression causing it to take more than 5 seconds to load in many cases</li><li>add back our fix for an upstream Android bug causing null pointer exception system_server crash in InputMethodManagerService triggered when ending user sessions because it turns out to still be required after Android 15 QPR1</li><li>fix upstream Android bug causing null pointer exception system_server crash in NotificationManagerService</li><li>Contacts: improve dark theme color contrast</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.232</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.173</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.119</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.61</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): fix very minor Android 15 QPR1 regression causing the kernel commit hash to be omitted from the kernel version string and the Unix epoch to be used as the build time instead of the kernel commit timestamp</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/75">version 75</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.200.0">version 131.0.6778.200.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-152">version 152</a></li><li>add developer option to log binder transactions</li><li>fix ignoring harmless fingerprint-service.goodix crash for our system service crash reporting</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024121200">2024121200</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024121200">2024121200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120900 release:</p><ul><li>SystemUI: disable migrate_clocks_to_blueprint and communal_hub flags to avoid upstream Android 15 QPR1 lockscreen layout regressions</li><li>fix upstream bug causing the Microphone (RECORD_AUDIO) permission to be required for for local audio routing via REMOTE_SUBMIX instead of only the MODIFY_AUDIO_ROUTING permission with this explicit purpose (this caused Android Auto to require the Microphone permission for routing audio on both the stock OS and GrapheneOS, but it impacts GrapheneOS more due to permissions not being granted by default to Android Auto and most people not wanting to give it the Microphone permission)</li><li>Settings: show current app battery usage mode in summary of App battery usage item</li><li>Settings: add back Unrestricted battery usage option to App battery usage screen to undo the usability regression introduced by Android 14 QPR2 where Optimized vs. Unrestricted was hidden away in an inner mode accessed by pressing the text next to an allow background toggle for controlling the Restricted mode (they likely did this to discourage users enabling Unrestricted, but GrapheneOS users need this much more than stock OS users especially if they don't use sandboxed Google Play and the new UI is very confusing/misleading instead of simply giving users a direct choice between the 3 modes)</li><li>Dialer: add proper dark mode support for dialogs</li><li>Android Debug Bridge: fix upstream use-after-free bug for network-based connections which is being caught by our always enabled hardware memory tagging support for the base OS in hardened_malloc</li><li>Android Debug Bridge: backport support for v4 signatures in streaming app installs from Android's development branch to support updating GrapheneOS apps directly with the streaming-based ADB install commands instead of needing to push them to the device and then install them (this stopped working after Android 15 since we had to replace signed fs-verity metadata with v4 signatures for our implementation of extending verified boot to system APK updates to close a major security hole in standard Android verified boot)</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.135.0">version 131.0.6778.135.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120900">2024120900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120900">2024120900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120702 release:</p><ul><li>Sandboxed Google Play compatibility layer: fix Android Auto Bluetooth audio regressions from Android 15 QPR1</li><li>CarrierConfig2 (app created by GrapheneOS to replace Google CarrierSettings): add support for new ICCID MVNO type in Android 15 QPR1</li><li>CarrierConfig2: add support for new ApnItem fields Android 15 QPR1</li><li>CarrierConfig2: change user-facing carrier settings version string prefix to match Google Carrier Settings to avoid confusion when comparing to the stock OS</li><li>delay activation of the Allow button for the Android Debug Bridge USB authorization dialog by 1 second to make it much harder to accidentally grant access</li><li>Permission Controller: delay activation of the Allow button(s) for runtime permission dialogs by 1 second to make it much harder to accidentally grant access</li><li>Permission Controller: disable all caps text theme by default to match the Settings app style</li><li>Permission Controller: move "Turn off" action from overflow menu to the toolbar for both Storage Scopes and Contact Scopes</li><li>Permission Controller: fix Contact Scopes UI issue where "Allow" could still be selected in the permission menu with Contacts Scopes enabled which would not actually disable Contact Scopes and allow the permission</li><li>Settings: add a dedicated App info &gt; Storage &gt; Manage storage button for apps with a manage storage space activity instead of replacing the standard user interface with it especially since the app's own implementation may not support clearing all storage and may not work at all</li><li>Settings: fix minor back navigation issue for our duress PIN/password UI where it would open a new authentication activity instead of going back to the previous screen</li><li>prevent crashes caused by upstream Android bugs when a Mock Location provider is added or removed by avoiding ever removing location providers at runtime by keeping them around as disabled providers</li><li>stop temporarily always enabling system crash notifications since the initial Android 15 QPR1 testing is completed</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.228</li><li>adevtool: update carrier_settings and carrier_list protobuf parsers for Android 15 QPR1</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120702">2024120702</a></h3><p>This release is specific to 9th generation Pixels and is being published to provide a proper fix for the GPU driver regression we ran into with Android 15 QPR1 so we can switch back to the standard GrapheneOS Linux 6.1 GKI LTS branch.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120702">2024120702</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024120701 release:</p><ul><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch back to standard GrapheneOS 6.1 kernel based on 6.1.118 instead of the tag based on 6.1.84 for AOSP and the stock OS which was used as a workaround for a Mali GPU kernel driver bug in the previous OS release</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): switch to Mali GPU kernel driver from Android 15 QPR2 Beta 1 which includes a fix for the massive mmap bug which caused lag and both app/system wide stalls/crashes with a newer LTS kernel revision</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120701">2024120701</a></h3><p>This release is specific to 9th generation Pixels and is being published to provide a temporary workaround for a major Mali GPU kernel driver issue introduced in Android 15 QPR1. The issue was caught during our Alpha channel testing and resulted in the last release being cancelled for 9th generation Pixels.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120701">2024120701</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024120700 release:</p><ul><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): temporarily switch to a dedicated GKI kernel branch based on the much older revision used by the stock OS and AOSP (6.1.84 instead of 6.1.118) to resolve major Mali GPU kernel driver regressions, which can then be narrowed down further after we have an initial workaround for the crashes/stalls caused by the driver changes</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120700">2024120700</a></h3><p>This release is based on Android 15 QPR1, the first quarterly release of Android 15.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120700">2024120700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120400 release:</p><ul><li>full 2024-12-05 security patch level</li><li>rebased onto AP4A.241205.013 Android Open Source Project release (December quarterly release of Android 15)</li><li>temporarily always enable system crash notifications to help users find Android 15 QPR1 regressions</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.227</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>kernel (6.1): add back one of the two f2fs defragmentation patches we reverted now that it's backported in Android 15 QPR1, since the other change was the source of the major regression rather than this one and it now has broad testing upstream without the broken change we still have reverted</li><li>kernel (Pixel Tablet): make SYN43752 Wi-Fi/Bluetooth driver build reproducible by dropping Broadcom's inclusion of the absolute path to the build directory as we've already done for all other 6th/7th/8th generation Pixels</li><li>kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): make BCM4390 Wi-Fi/Bluetooth driver build reproducible by dropping Broadcom's inclusion of the absolute path to the build directory as we've already done for 6th/7th/8th generation Pixels</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120400">2024120400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120400">2024120400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024120200 release:</p><ul><li>Gallery: remove the Delete option for items that represent multiple images since the UI is badly designed and makes it too easy to accidentally delete images, especially since the app doesn't support the Trash API</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.104.0">version 131.0.6778.104.0</a></li><li>switch back to correct APK for Vanadium Config to fix using our full content filter list and to unblock out-of-band updates (this regressed in the <a href="https://grapheneos.org/releases#2024112700">2024112700</a> OS release and was noticed with the new Vanadium release)</li><li>envsetup.sh: reuse BUILD_DATETIME and BUILD_NUMBER from environment to make automation for reproducible builds slightly simpler instead of needing to export them after sourcing envsetup.sh</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024120200">2024120200</a></h3><p>This is an early December security update release based on the December 2024 security patch backports since the quarterly Android Open Source Project and stock Pixel OS release (Android 15 QPR1) scheduled for this month hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024120200">2024120200</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024112700 release:</p><ul><li>full 2024-12-01 security patch level</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.118</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.58</li><li>PDF Viewer: update to <a href="https://github.com/GrapheneOS/PdfViewer/releases/tag/20">version 20</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-151">version 151</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024112700">2024112700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024112700">2024112700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024111800 release:</p><ul><li>Settings: revert our previous attempt at disabling Bluetooth contact sharing by default for hands-free calling devices in our <a href="https://grapheneos.org/releases#2024111700">2024111700</a> release because it didn't address an upstream Android security bug and having the toggle off by default caused the upstream bug to impact pairing directly in the Settings app (foreground) if the user would have toggled it off instead of only outside the Settings app such as through the Bluetooth Quick Tile (background)</li><li>Settings: fix an upstream Android security bug causing Bluetooth contact sharing to be enabled for hands-free calling devices even though the dialog shows it will be disabled, which only previously occurred for pairing invoked from outside the Settings app but also began impacting pairing from within it due to disabling the contact sharing setting by default</li><li>Settings: always disable Bluetooth contact sharing by default instead of enabling it by default for pairing requests made by the user in the foreground where the user can choose to disable it</li><li>fix upstream bug breaking in-call service components provided by packages only installed in secondary users, which was mainly occurring with user installed Android Auto which unlike the stock OS isn't installed in Owner by default to mask this bug</li><li>Sandboxed Google Play compatibility layer: allow Android Auto foreground services to have while-in-use permissions when wired and/or wireless Android Auto special permissions are granted by the user to fix voice commands in some cases</li><li>Sandboxed Google Play compatibility layer: make Google text-to-speech app queryable by other apps in the same profile by default as it is on the stock OS since libraries using it don't declare the query explicitly (note apps and their libraries can declare any queries they want including for any app with a launcher activity and there's no approval along with there being other ways to detect apps)</li><li>Sandboxed Google Play compatibility layer: show the notification for Play services not having Unrestricted battery usage enabled one more time for existing users since not having it now causes more severe delays FCM push messaging including notifications or more urgent events such as incoming calls to an app like Signal which uses FCM for this when available</li><li>Sandboxed Google Play compatibility layer: add notification about Play services having background data usage restricted which will break FCM when only mobile data is available (no Wi-Fi access)</li><li>Sandboxed Google Play compatibility layer: don't show battery usage notification for Play services when it has the Network toggle revoked since the user clearly doesn't want the functionality depending on Unrestricted background power usage</li><li>Settings: opt-out of Android 15 edge-to-edge for the developer options app picker activity since it's not properly supported yet (upstream bug)</li><li>Setup Wizard: avoid incredibly rare edge case crash (uncaught exception) when trying to disable OEM unlocking when it's already disabled and not allowed to be disabled by the carrier</li><li>fix avoiding reporting harmless fingerprint-related crash with our added crash reporting</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.57</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.81.0">version 131.0.6778.81.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-150">version 150</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024111800">2024111800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024111800">2024111800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024111700 release:</p><ul><li>temporarily revert putting Private Space data at rest when locking it because some users want to be able to unlock it with their fingerprint so we need to make this into a toggle rather than hard-wired (will be added back in a near future release as an option)</li><li>switch default display color mode to Natural for fresh installs for more accurate image/video colors and to avoid bugs tied to the other options</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024111700">2024111700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024111700">2024111700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024110700 release:</p><ul><li>Private Space: put data at rest immediately after stopping the profile to match user profile behavior instead of only on reboot</li><li>fix Mock Location on devices without any standard location providers (only Pixel Tablet)</li><li>backport mainline APEX module patches for ART, DNS Resolver, DocumentsUI, Media, Media Provider, Network Stack, PermissionController, Remote Key Provisioning and Wi-Fi</li><li>raise maximum running users from the standard 3 to 4 for 6GB memory, 6 for 8GB memory, 10 for 12GB memory and 14 for 16GB memory</li><li>Settings: disable Bluetooth contact sharing by default for hands-free calling devices</li><li>Settings: fix Private Space handling in Passwords &amp; accounts &gt; Additional services</li><li>Settings: fix multiple cases of missing user profiles handling for added settings</li><li>Dialer: fix RTT related crash from not using the correct theme configuration</li><li>Contacts Provider: work around upstream bug causing deadlock with contact scopes</li><li>temporarily don't report harmless fingerprint-service.goodix crash</li><li>temporarily disable hardened_malloc for vendor audio service due to Pixel Tablet bug</li><li>Sandboxed Google Play compatibility layer: significantly rework client side compatibility layer to avoid deadlocks and to avoid allowing starting apps with no exported components (i.e. not even a launcher activity)</li><li>Sandboxed Google Play compatibility layer: overhaul approach to raising Google Play components to the foreground to avoid it always being considered in the foreground while also solving an issue triggered in a rare edge case at startup</li><li>Sandboxed Google Play compatibility layer: stop Play Store from attempting to auto-install some system component packages, such as "Android System SafetyCore" (com.google.android.safetycore) and "Android System Key Verifier" (com.google.android.contactkeys)</li><li>Sandboxed Google Play compatibility layer: fix Android Auto voice commands not working in some cases</li><li>Sandboxed Google Play compatibility layer: fix one of the Android Auto permission toggle checks for companion devices</li><li>Sandboxed Google Play compatibility layer: extend opt-in Android Auto "Allow permissions for handling phone calls" toggle to allow access to Bluetooth adapter hardware address access for hands-free audio support with wired Android Auto rather than only wireless Android Auto where the baseline toggle already grants access to that</li><li>Sandboxed Google Play compatibility layer: don't stop apps that use Dynamite modules when Play services stops since the new version of the Dynamite client library handles dynamic re-connection without app restart and older ones will handle this by stopping</li><li>kernel (5.10, 5.15, 6.1, 6.6): disable unused TIPC protocol support</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.170</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.115</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>System Updater: show failure notification for update_engine errors</li><li>System Updater: add missing UpdateEngine.unbind() to avoid extra callbacks for progress and error reporting</li><li>System Updater: avoid treating non-404 errors such as a connection failure as lack of an incremental update</li><li>System Updater: handle a partially downloaded incremental update being removed from the server by falling back to the full update instead of retrying resuming the incremental download until the next update (this will allow us to remove an incremental for the latest available version to save storage space or work around a potential update_engine bug without it causing download resumption errors)</li><li>System Updater: delete stale update from a failed download of a previous release slightly earlier</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.102.1">version 130.0.6723.102.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/131.0.6778.39.0">version 131.0.6778.39.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-149">version 149</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024110700">2024110700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024110700">2024110700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024110400 release:</p><ul><li>full 2024-11-05 security patch level</li><li>rebased onto AP3A.241105.007 Android Open Source Project release (November monthly release of Android 15)</li><li>ignore Person.Builder.setUri() when Contact Scopes is enabled since apps can't access the contact's URI with Contact Scopes enabled (this resolves the incompatibility between Contact Scopes and apps attaching contact information to notifications which was introduced by a November Android Security Bulletin patch)</li><li>fix "App info" uninstall dialog link added by GrapheneOS not working in some cases for secondary profile apps</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-147">version 147</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.102.0">version 130.0.6723.102.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024110400">2024110400</a></h3><p>This is an early November security update release based on the November 2024 security patch backports since a monthly Android Open Source Project and stock Pixel OS release hasn't been published yet.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024110400">2024110400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024103100 release:</p><ul><li>full 2024-11-01 security patch level</li><li>fix a bunch of upstream Android bugs breaking SMS and MMS functionality in secondary profiles, including both Android 15 regressions and pre-existing issues</li><li>backport upstream Android fix for UsageStatsDatabase locking from the AOSP main branch</li><li>Sandboxed Google Play compatibility layer: fix flag overrides being partly ignored on recent versions</li><li>add workaround for rare system_server null pointer exception crash in showShutdownDialog()</li><li>add missing null handling for extended application error report</li><li>fix upstream bug causing App Not Responding link to not work properly outside of Owner</li><li>Settings: avoid opening parent user log viewer in nested profiles (Private Space, work profile)</li><li>System Updater, GmsCompat: reduce included SettingsLib components to reduce the size of these apps from around 10MB each to below 4MB each</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-146">version 146</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024103100">2024103100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024103100">2024103100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102400 release:</p><ul><li>improve our existing fix for an upstream Android bug impacting apps using the telephony service in secondary users to fix support for disabling re-routing of Google Play location requests to the OS for fresh installs of sandboxed Google Play since the release of Android 15</li><li>Sandboxed Google Play compatibility layer: extend wired Android Auto toggle to additional methods used in edge cases</li><li>fix changing USB-C port control setting to a lower security level not fully applying until after locking and unlocking</li><li>Settings: fix per-app exploit protection toggles for Private Space</li><li>Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS</li><li>raise system log buffer size from 256KiB to 512KiB to make logs obtained by users reporting issues more useful</li><li>enable stamp configuration for microdroid kernel builds to set LOCALVERSION based on version control information as expected</li><li>kernel (6.6): disable unused hibernation support</li><li>kernel (6.6): disable unused TIOCSTI ioctl (already blocked via standard Android SELinux ioctl filtering)</li><li>kernel (6.6): disable unused cachestat system call (already blocked for apps via standard Android seccomp-bpf policy)</li><li>kernel (6.6): enable random kmalloc caches for x86_64 and microdroid too, not only bare metal arm64</li><li>kernel (6.6): enable full struct randomization for x86_64 and microdroid too, not only bare metal arm64</li><li>kernel (6.6): enable DEBUG_SG for microdroid too, not only bare metal</li><li>kernel (6.6): enable FORTIFY_SOURCE for microdroid too, not only bare metal</li><li>kernel (6.6): disable BINFMT_MISC for microdroid too, not only bare metal</li><li>kernel (6.6): disable RSEQ for microdroid too, not only bare metal</li><li>kernel (6.6): add SYSRQ restrictions for microdroid too, not only bare metal</li><li>kernel (6.6): use the same KFENCE configuration for microdroid as bare metal</li><li>mark Sensors permission as implicitly added</li><li>avoid adding Sensors permission to hasCode=false packages</li><li>improve our implementation of extending verified boot to out-of-band shared library APK updates</li><li>Log Viewer: add userType line to header in non-Owner users</li><li>Log Viewer: add targetSdk and sharedUid to package info header</li><li>System Updater: update minimum and target API level to 35 (Android 15)</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.86.0">version 130.0.6723.86.0</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/5">version 5</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/87">version 87</a></li><li>Sandboxed Google Play compatibility layer: fix development support in OS debug builds</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102400">2024102400</a></h3><p>Notice which will not impact most users: apps which were only installed in secondary users but not Owner before updating to Android 15 and which were then installed in Owner after updating to Android 15 will have a one-time revocation of their Network/Sensors permissions after updating to this release as a minor consequence of migrating them from Android 14 again.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102400">2024102400</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102100 release:</p><ul><li>switch back our original stricter approach to DNS leak blocking from our <a href="https://grapheneos.org/releases#2024050900">2024050900</a> release with an additional fix for an Android DNS routing bug causing requests to the VPN DNS servers to be routed incorrectly, which should avoid the compatibility issues experienced with certain VPN apps when we tried to ship it before</li><li>avoid resetting Network or Sensors back to the global default after app updates in a specific case when migrating the state from Android 14 or earlier</li><li>add an extra one-time migration of Network and Sensors being disabled in Android 14 to Android 15 to work around an issue with the previous migration of the permission state which occurred for some users with some of their apps</li><li>fix ancient Android bug causing widgets to disappear from the user's home screen when the user stops, which was a major usability issue for secondary users</li><li>Keyboard: extend fix for upstream layout bug in landscape mode to fully fix it for 3-button navigation in addition to the default gesture navigation</li><li>Gallery: fix upstream cropping activity bug when both the input and output URI is the same to fix setting profile pictures for user profiles</li><li>raise backup service transport (Seedvault) timeout from 10 minutes / 5 minutes to 60 minutes / 30 minutes to handle very large backups, particularly for the device-to-device mode which includes nearly all app data</li><li>temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps (revert was not applied for Android 15 port)</li><li>Sandboxed Google Play compatibility layer: add stubs for update_engine wrapper API to avoid potential Play services crashes if the existing approaches to disable the update service fail</li><li>Pixel 8, Pixel 8 Pro, Pixel 8a: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>use hardened GrapheneOS 6.6 LTS kernel for microdroid virtual machines for both arm64 and x86_64</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.73.0">version 130.0.6723.73.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-144">version 144</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-145">version 145</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102100">2024102100</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102100">2024102100</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024102000 release:</p><ul><li>Keyboard: fix upstream bug triggered by Android 15 causing layout to be cut off in landscape mode on devices with a display cutout</li><li>enforce stack clash protection for arm64</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024102000">2024102000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024102000">2024102000</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101900 release:</p><ul><li>Sandboxed Google Play compatibility layer: adjust one of the stubs for the NearbyManager API to resolve a remaining issue</li><li>Sandboxed Google Play compatibility layer: use per-network MAC randomization and enable send device name for wireless Android Auto networks to avoid introducing compatibility issues by default for certain cars with either our per-connection MAC randomization feature or default disabled DHCP device name</li><li>adjust hasSendDhcpHostnameEnabledChanged() based on new "Send device name" setting value to avoid introducing a permission issue</li><li>temporarily disable memory tagging for the Pixel Camera Services app until memory corruption bugs are resolved</li><li>extend one-time removal of leftover Vanadium library state to handle it for Alpha/Beta users who removed it from Owner themselves but still have it in other users</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101900">2024101900</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101900">2024101900</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101801 release:</p><ul><li>drop existing "Send device name" setting value for all Wi-Fi networks to start from our default of disabled for all users including people who updated to the Beta and Alpha releases already (we already switched the default to off for new networks in <a href="https://grapheneos.org/releases#2024101800">2024101800</a>)</li><li>limit removal of shared library updates as part of our system APK verified boot feature to those equal to the OS version since older versions are already dealt with and removing them this way leaves behind stale package state cluttering the UI</li><li>run a one-time task to remove leftover Vanadium library state to avoid showing a list of old versions</li><li>Settings: fix upstream Android 15 bug causing a crash for the network privacy menu when the AP name has special characters</li><li>Sandboxed Google Play compatibility layer: add stubs for NearbyManager API to avoid crashes from Find My Device feature</li><li>Dialer: fix new upstream crashes in Android 15 caused by R8 optimization</li><li>fix upstream Android 15 bug causing a Wallet quick tile provided by a user installed app to be automatically added, which isn't intended</li><li>fix upstream Android bug causing crash when showing app's first confirmation prompt for PackageInstaller</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101801">2024101801</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101801">2024101801</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101800 release:</p><ul><li>Sandboxed Google Play compatibility layer: only check for SET_BIOMETRIC_DIALOG_ADVANCED permission for GmsCompat apps to avoid causing crashes elsewhere</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101800">2024101800</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101800">2024101800</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101701 release:</p><ul><li>stop enabling the new Android 15 "Send device name" toggle for Wi-Fi networks by default to continue avoiding sending the device model (default) or user configured device name as a DHCP client hostname (Alpha channel testers on our previous Android 15 releases need to toggle it off for each existing network themselves if they don't want it)</li><li>Sandboxed Google Play compatibility layer: handle lack of SET_BIOMETRIC_DIALOG_ADVANCED permission</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101701">2024101701</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101701">2024101701</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101700 release:</p><ul><li>Sandboxed Google Play compatibility layer: declare C2DM SEND permission ourselves in addition to the already covered READ_GSERVICES and C2DM RECEIVE to avoid issues with Firebase Cloud Messaging for fresh installs of sandboxed Google Play without the Google Services Framework (GSF) app that's no longer a dependency in our App Store for Android 15</li><li>Settings: enable our per-connection Wi-Fi MAC randomization feature by default for new networks again on Android 15 instead of the standard per-network approach</li><li>Settings: extend change in the previous release for hiding inaccurate Private Space information</li><li>persist GrapheneOS-specific package state when archiving an app</li><li>Radio Info, Wi-Fi testing (Settings): opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bug)</li><li>stop excluding Gallery from Private Space</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101700">2024101700</a></h3><p>This is the second release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. It fixes nearly all of the reported regressions, but we have a couple more things to fix in another release later today before the release will be able to reach Beta and Stable.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101700">2024101700</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101600 release:</p><ul><li>fix upstream Android 15 bug in InputMethodManagerService.resetDefaultImeLocked() causing system_server crash from null pointer exception</li><li>fix upstream Android 15 bug in KeyguardUpdateMonitor.onPostureChanged() causing SystemUI crash on foldable devices from null pointer exception due to GrapheneOS currently only having fingerprint unlock and not face unlock</li><li>Messaging: add new permissions needed on Android 15 (READ_CELL_BROADCASTS and RECEIVE_WAP_PUSH) which avoids it prompting to be set as the default app instead of completing certain actions requiring privileges it was missing</li><li>Settings: port our default enabled per-connection MAC randomization option to the new Compose-based UI in Android 15 so the default mode displays properly and it can be restored back to the default value</li><li>fix Android 15 port of our toggle for disabling granting our Sensors permission by default</li><li>Storage Manager, Emergency Info: opt-out of Android 15 edge-to-edge since it's not properly supported yet (upstream bugs)</li><li>Sandboxed Google Play compatibility layer: replace GmsCompatConfig Bluetooth stubs with in-place checks for improved reliability and readability</li><li>ignore the standard stock OS configured Factory Reset Protection since installing GrapheneOS implies the ability to bypass it via the device being unlocked and if we added our own anti-theft system it would not use the same approach using Google account recovery</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release</li><li>Launcher: remove "Install in private" shortcut for now since the standard behavior of opening the app in the first party app store isn't currently useful on GrapheneOS right now and is confusing to users</li><li>Settings: hide inaccurate "access private space when hidden" text that's not currently relevant to GrapheneOS since AOSP doesn't have this launcher feature yet</li><li>Keyboard: remove launcher icon to avoid it temporarily showing up in new users/profiles (not a recent regression)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-142">version 142</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-143">version 143</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101600">2024101600</a></h3><p>This is the initial release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. We had previously ported all of our features to Android 15 based on the Beta releases and have been finishing it up based on the early September release of the source code for Android 15. Our initial port of all our features was completed on September 3rd and we've been polishing it up while we've been working on regular development.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101600">2024101600</a> (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, emulator, generic, other targets)</li></ul><p>Changes since the 2024101200 release:</p><ul><li>full 2024-10-05 security patch level since the Pixel patches were disclosed in the Pixel Update Bulletin today</li><li>rebased onto AP3A.241005.015 Android Open Source Project release (Android 15)</li><li>full port of GrapheneOS features to Android 15 including integration of our features with the new Android 15 features including Private Space</li><li>Sandboxed Google Play compatibility layer: add stubs to fully remove the need for the Google Services Framework (GSF) app for fresh installs of sandboxed Google Play, which has been removed as a dependency in our app repository for Android 15+, but it should still be kept for existing installs to avoid potential issues</li><li>Pixel 9 Pro Fold: add assorted device-specific Settings and SystemUI changes to better match the stock OS</li><li>disable Bluetooth auto-on feature by default</li><li>temporarily enable system crash notifications unconditionally for the initial release based on Android 15 release</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.56</li><li>Seedvault: update to a newer revision (will be replaced with a better backup implementation in the future)</li><li>Seedvault: minor changes to prepare for a complete fork and overhaul in the future</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/130.0.6723.58.0">version 130.0.6723.58.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-141">version 141</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024101200">2024101200</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200-redfin">2024101200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200">2024101200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024101200-caimito">2024101200-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024100800 release:</p><ul><li>hardened_malloc: preserve hardware memory tagging enforcement flag for slab mappings when releasing free slabs</li><li>hardened_malloc: improve accuracy of probability hint for hardware memory tagging branches</li><li>temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps</li><li>Log Viewer: add "bootloader unlocked" and "dev options enabled" flags to header</li><li>Log Viewer: add "More info" button to native crash reports</li><li>Log Viewer: include contents of App Not Responding (ANR) stack traces file in ANR error reports</li><li>Log Viewer: omit processUptime header line when it's unknown</li><li>Settings Intelligence (Settings search): fix upstream bug resulting in corruption of the query history database which leads to the search crashing</li><li>Launcher: mark 2x2 workspace option as being for phones</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.54</li><li>adevtool: update carrier settings</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.100.0">version 129.0.6668.100.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024100800">2024100800</a></h3><p>This is an early October security update release based on the October 2024 security patch backports since a monthly Android Open Source Project and stock Pixel OS release based on Android 14 QPR3 hasn't been published yet. Android 15 is scheduled for release around October 15th and they may not have a monthly release based on Android 14 QPR3 before then.</p><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800-redfin">2024100800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800">2024100800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024100800-caimito">2024100800-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024092900 release:</p><ul><li>full 2024-10-01 security patch level</li><li>overhaul the implementation of our USB-C port control feature to improve robustness and error reporting</li><li>fix an upstream Android Bluetooth use-after-free bug uncovered by GrapheneOS hardware memory tagging that's triggered when obtaining internet access from another device via Bluetooth</li><li>fix an upstream Android race condition bug in handling of system error files to avoid using the wrong timestamps for system errors and then reporting them as new errors after reboot</li><li>work around an upstream Android bug causing our Log Viewer feature to stop working after system_server restarts</li><li>add handling for early boot-time system journal notifications</li><li>kernel (5.10, 5.15, 6.1, 6.6): backport upstream patch fixing a hole in SELinux W^X enforcement</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.226</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.167</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.112</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.53</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.81.0">version 129.0.6668.81.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-140">version 140</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024092900">2024092900</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900-redfin">2024092900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900">2024092900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024092900-caimito">2024092900-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024091900 release:</p><ul><li>extend standard Android eBPF filter to prevent apps sending multicast packets outside of the VPN tunnel either directly or indirectly via kernel-generated multicast traffic (IGMP, MLD) when leak blocking is enabled (2nd generation implementation with improved app compatibility)</li><li>add netfilter-based multicast firewall only permitting sending multicast packets to permitted tunnel interfaces for the process to prevent apps sending multicast packets through a VPN tunnel for another profile (2nd generation implementation with improved IPv6 and app compatibility)</li><li>Sandboxed Google Play compatibility layer: add stub for Bluetooth AdvertisingSetParameters.setOwnAddressType() API needed for receiving files through Quick Share</li><li>Sandboxed Google Play compatibility layer: ignore GattServer in BTLeAdvertiser.startAdvertisingSet() needed for receiving files through Quick Share</li><li>Auditor: add battery optimization exception to avoid delays for the opt-in scheduled remote verification since users rarely interact with the app resulting in it being placed into semi-restricted standby buckets</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/86">version 86</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/26">version 26</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.70.0">version 129.0.6668.70.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-138">version 138</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-139">version 139</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024091900">2024091900</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900-redfin">2024091900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900">2024091900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091900-caimito">2024091900-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024091700 release:</p><ul><li>temporarily revert multicast leak blocking firewall due to causing legacy 5th gen devices to lose compatibility with IPv6-only carriers along with causing certain compatibility issues with IPv6 on Wi-Fi</li><li>temporarily revert multicast leak blocking eBPF filter extensions until app compatibility is addressed in a similar way as the Network permission mimics non-security errors</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024091700">2024091700</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700-redfin">2024091700-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700">2024091700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024091700-caimito">2024091700-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024090400 release:</p><ul><li>Sandboxed Google Play compatibility layer: handle the updated client dynamite module initialization sequence</li><li>extend standard Android eBPF filter to prevent apps sending multicast packets outside of the VPN tunnel either directly or indirectly via kernel-generated multicast traffic (IGMP, MLD) when leak blocking is enabled</li><li>add netfilter-based multicast firewall only permitting sending multicast packets to permitted interfaces for the process to prevent apps sending multicast packets through a disallowed interface such as a VPN tunnel for another profile</li><li>exclude com.android.rkpdapp from backup/restore to avoid breaking key provisioning for hardware key attestation including for Auditor (users can clear RemoteProvisioner system app data via Settings if they restored data for it and have this issue)</li><li>Pixel 9 Fold Pro: temporarily manually add resource overlays not yet automatically handled by adevtool from the stock Pixel OS to use the correct layout for quick settings, status bar, etc. and to provide the split folded/unfolded auto-rotate settings (this will be replaced by adevtool improvements before the end of the month since we'll need it for more resources in Android 15)</li><li>hardened_malloc: fix microdroid virtual machine compatibility by using armv8a+dotprod+memtag when enabling memory tagging instead of armv9+memtag</li><li>init: disable auto-reboot setup for microdroid virtual machines</li><li>expat: backport patches for CVE-2024-28757, CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492 (none of these is exploitable on official GrapheneOS since the DoS bug involves a feature Android doesn't use, the integer overflows require that size_t is 32-bit which is never going to be the case due to the code only being used in 64-bit processes and the negative parameter API issue requires a usage pattern not done by Android, but the integer overflows would be exploitable on an official build for a 32-bit device or a 64-bit device still partially using 32-bit drivers)</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.225</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.165</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.104</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.51</li><li>TalkBack (screen reader): update dependencies</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.127.0">version 128.0.6613.127.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.146.0">version 128.0.6613.146.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/129.0.6668.54.0">version 129.0.6668.54.0</a></li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/25">version 25</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/85">version 85</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/4">version 4</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-136">version 136</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-137">version 137</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024090400">2024090400</a></h3><p>Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400-redfin">2024090400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400">2024090400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024090400-caimito">2024090400-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024083100 release:</p><ul><li>full 2024-09-05 security patch level</li><li>rebased onto AP2A.240905.003 (generic) and AD1A.240905.004 (caimito) Android Open Source Project releases</li><li>Sandboxed Google Play compatibility layer: add support for using GSF 34 on SDK 35 (Android 15) to handle the case where users have just upgraded the OS but haven't yet updated GSF</li><li>Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix an upstream use-after-free bug present in 2 drivers</li><li>allow Pixel Thermometer and Fitbit to see each other as a special case</li><li>allow current launcher to see the Pixel Thermometer app as a special case</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.47</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-134">version 134</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-135">version 135</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024083100">2024083100</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100-redfin">2024083100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100">2024083100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024083100-caimito">2024083100-caimito</a> (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)</li></ul><p>Changes since the 2024082200 release:</p><ul><li>don't hide Exploit protection Safety Center item in secondary users</li><li>Settings: improve UI for GrapheneOS app toggles including adding a screen for viewing the values across apps for each toggle</li><li>add more infrastructure for blocking dynamic code loading</li><li>Settings: add per-app memory dynamic code loading restriction toggle (applies to both native code and Android Runtime class loading for Java/Kotlin)</li><li>Settings: add per-app storage dynamic code loading restriction toggle (applies to both native code and Android Runtime class loading for Java/Kotlin), temporarily without a global toggle until Google phases out the old dynamite module system for Google Play due to many apps temporarily depending on this through it</li><li>Settings: add per-app WebView JIT restriction toggle</li><li>add production support for the Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL and Pixel 9 Pro Fold</li><li>add support for enabling app association restrictions without exemptions (currently for use with Pixel Thermometer)</li><li>add support for Pixel Thermometer app available from our App Store for the Pixel 8 Pro, Pixel 9 Pro and Pixel 9 Pro XL with strict isolation from other apps</li><li>add missing feature compatibility matrix definitions (mainly for 9th generation Pixels)</li><li>Contact Scopes: explicitly set initialization order after ContactsProvider2 to avoid uncaught exceptions from a race</li><li>kernel (6.1): disable unused hibernation support</li><li>kernel (6.1, 6.6): enable struct randomization in the full mode with a deterministic seed based on kernel commit timestamp (we plan to also incorporate the device family and eventually make the seed specific to each device model, but it will increase our build/testing workload)</li><li>kernel (6.6): enable random kmalloc caches</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.96</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.46</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.88.1">version 128.0.6613.88.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.99.0">version 128.0.6613.99.0</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/84">version 84</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-131">version 131</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-132">version 132</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-133">version 133</a></li><li>drop restriction on modifying GrapheneOS-specific per-package settings via ADB shell since it makes certain important testing require debug builds and has no real security value</li><li>flash-all.sh: restore POSIX sh compatibility to allow using sh instead of bash on systems where sh is dash or another non-bash-compatible shell</li><li>add support for using backslashes in the passphrases for encrypting the keys for signing OS releases</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024082200">2024082200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082200-redfin">2024082200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082200">2024082200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024082000 release:</p><ul><li>Settings: fix regression in the previous release which blocked it reaching the Stable channel by making the duress PIN/password configuration unavailable in secondary users again (it was only usable when the secondary user had the same unlock PIN/password as the Owner user)</li><li>adevtool: remove non-functional repair mode support</li><li>adevtool: remove non-functional digital car key support (requires privileged Google Play)</li><li>adevtool: remove invalid clock font family overlay (google-sans-clock font not included)</li><li>adevtool: update carrier settings</li><li>Pixel 8a: add Let's Encrypt (ISRG) roots for Samsung gnssd SUPL connections via adevtool instead to share the implementation with 9th generation Pixels</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/83">version 83</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/128.0.6613.88.0">version 128.0.6613.88.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024082000">2024082000</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082000-redfin">2024082000-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024082000">2024082000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080600 release:</p><ul><li>Settings: enable Safety Center and port all of the relevant GrapheneOS settings to it both to provide the more modern user interface and to prepare for the release of Android 15</li><li>hide Safety Center camera extensions fallback toggle when it's not relevant (not used on Pixels)</li><li>Package Installer: fix upstream bug causing null pointer exception in rare edge cases including a rare race condition</li><li>require Owner user credential to check whether a duress PIN/password is enabled as hardening against potential UI bugs such as the upstream predictive back gesture issue we patched in the Settings app</li><li>apply upstream change for 6th generation Pixels making snapuserd available in recovery to avoid a problem in a rare edge case where a factory reset occurs before finishing booting a new update</li><li>apply minor upstream fixes for Settings which were temporarily only shipped for certain Pixels</li><li>add fastboot to otatools.zip for optimized factory images generation</li><li>flash-all: raise minimum fastboot version to 35.0.1</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.223</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.164</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.95</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.45</li><li>remove duplicate Android.bp from unpacked otatools.zip to avoid breaking subsequent builds when it's unpacked in the source tree</li><li>add Android 15 Beta build configuration for early development/testing of our Android 15 port via an ap2f release configuration enabling all of the available Android 15 feature flags</li><li>port GrapheneOS changes to new code for Android 15 used by our Android 15 Beta build configuration</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.0">version 127.0.6533.104.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.1">version 127.0.6533.104.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.2">version 127.0.6533.104.2</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.104.3">version 127.0.6533.104.3</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-128">version 128</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-129">version 129</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-130">version 130</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080600">2024080600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080600-redfin">2024080600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080600">2024080600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080500 release:</p><ul><li>full 2024-08-05 security patch level</li><li>rebased onto AP2A.240805.005 Android Open Source Project release</li><li>adevtool: update dependencies</li><li>adevtool: improve code quality</li><li>adevtool: use fastboot packs to extract firmware images to avoid the need to download over-the-air updates, which also removes the dependency on python and python-protobuf for extracting vendor files</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.103.0">version 127.0.6533.103.0</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/74">version 74</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080500">2024080500</a></h3><p>This is an early August security update release based on the August 2024 security patch backports. This month's release of the Android Open Source Project and stock Pixel OS should be available later today or tomorrow and we'll quickly release an update based on it following this one.</p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080500-redfin">2024080500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080500">2024080500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080200 release:</p><ul><li>full 2024-08-01 security patch level</li><li>suppress crash notifications for 2 harmless crashes occuring on service shutdown for the Android Bluetooth service and Pixel wifi_ext service</li><li>enable memory tagging for the Pixel wifi_ext service again</li><li>Settings: disable predictive back gesture in PIN/password input activities to fix an upstream Android vulnerability</li><li>flash-all: remove unnecessary sleep after flashing AVB key</li><li>flash-all: exit on errors</li><li>flash-all.sh: avoid false negative for device model check</li><li>flash-all.bat: pause before exiting after an error</li><li>fastboot: add support for CLI install with the GrapheneOS optimized factory images format already used by the web installer (will reduce memory/storage usage for CLI installs and will reduce storage usage on the update servers by avoiding multiple factory image formats)</li><li>hardened_malloc: update libdivide to 5.1</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.43</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080200">2024080200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080200-redfin">2024080200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080200">2024080200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024080100 release:</p><ul><li>prevent VPN apps from having leaks to non-VPN DNS servers while not yet strictly preventing leaks to VPN DNS outside the VPN tunnel due to multiple VPN apps including Proton VPN not connecting reliably with stricter enforcement (in a future release, we can do strict blocking by default with an opt-out toggle and a list of known incompatible apps such as Proton VPN until the compatibility issue is resolved)</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-126">version 126</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-127">version 127</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/73">version 73</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024080100">2024080100</a></h3><p><strong>This release is only for the Alpha channel to replace the previous release.</strong></p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080100-redfin">2024080100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024080100">2024080100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024073100 release:</p><ul><li>revert VPN DNS leak protection again since it's still partially incompatible with Proton VPN and certain other apps for unknown reasons, although we did avoid a lot of the compatibility issues from last time</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024073100">2024073100</a></h3><p><strong>This release was only pushed out to the Alpha channel.</strong></p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024073100-redfin">2024073100-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024073100">2024073100</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024072800 release:</p><ul><li>add back our change to prevent app-based VPN implementations from leaking DNS requests when the VPN is down/connecting but without enforcement for VPN apps without DNS configured to avoid breaking compatibility in rare cases (our previous implementation in <a href="https://grapheneos.org/releases#2024050900">2024050900</a> had to be reverted before it reached Stable)</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/72">version 72</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.84.0">version 127.0.6533.84.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024072800">2024072800</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024072800-redfin">2024072800-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024072800">2024072800</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024071600 release:</p><ul><li>avoid isolating eUICC LPA (eSIM activation) app from third party apps to allow carrier activation apps to work (we still block communication with Google Play to avoid sending telemetry data to Google services when sandboxed Google Play is installed)</li><li>Pixel 8a: fix GNSS configuration to avoid occasional crashes of the service (Pixel 8a is currently the only Samsung GNSS device)</li><li>Settings: don't allow disabling user installed apps when uninstall is disallowed</li><li>Settings: drop code for supporting the legacy Settings UI</li><li>Sandboxed Google Play compatibility layer: avoid infinite wait for GmsCompatConfig update when call to App Store fails</li><li>enforce stack clash protection for x86_64</li><li>enforce minimum 64kiB stack guard size for arm64 due to the standard stack probe size of 64kiB</li><li>future proof our Bionic libc changes for dynamic 64k pages (hardened_malloc still doesn't support it)</li><li>flash-all: remove unnecessary reboot after flashing Android Verified Boot (AVB) key</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.222</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.163</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.92</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.42</li><li>adevtool: update to latest carrier settings</li><li>App Store: update to <a href="https://github.com/GrapheneOS/Apps/releases/tag/24">version 24</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/69">version 69</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/70">version 70</a></li><li>Camera: update to <a href="https://github.com/GrapheneOS/Camera/releases/tag/71">version 71</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/81">version 81</a></li><li>Auditor: update to <a href="https://github.com/GrapheneOS/Auditor/releases/tag/82">version 82</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.64.0">version 127.0.6533.64.0</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/127.0.6533.64.1">version 127.0.6533.64.1</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-124">version 124</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-125">version 125</a></li><li>fastboot: add support for generating web installer optimized factory images zip for an improved web install approach not requiring fastbootd</li><li>integrate generating web installation optimized factory images zip into release signing script</li><li>split script/release.sh to remove dependency on build output and the OS source tree (see the new instructions for signing releases)</li><li>rename script/release.sh to script/generate-release.sh</li><li>add script/generate-releases.sh wrapper script</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024071600">2024071600</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071600-redfin">2024071600-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071600">2024071600</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024071200 release:</p><ul><li>fix touch-to-unlock setting on devices with a power button fingerprint scanner (Pixel Fold, Pixel Tablet) which is normally always active with AOSP</li><li>avoid race for setting USB port mode when the lock method is set to none (lockscreen disabled)</li><li>Pixel Tablet: add non-standard toggle for enabling touchscreen frequency hopping to reduce ghost touches for users with problematic touchscreen hardware</li><li>kernel (5.10, 5.15): revert a USB change backported to kernel.org LTS that's causing DisplayPort alternate mode compatibility issues</li><li>Pixel 8a: fix GNSS configuration to avoid occasional crashes of the service (Pixel 8a is currently the only Samsung GNSS device)</li><li>backport mainline APEX module patches for Media Provider, Network Stack, Remote Key Provisioning and Wi-Fi</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.221</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.161</li><li>kernel (6.1): update to latest GKI LTS branch revision</li><li>kernel (6.6): update to latest GKI LTS branch revision</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-123">version 123</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024071200">2024071200</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071200-redfin">2024071200-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024071200">2024071200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070900 release:</p><ul><li>kernel (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a): temporarily revert disabling 32-bit ABI support due to rare cases of apps using a buggy anti-tampering library incorrectly calling 32-bit versions of system calls from 64-bit code even on devices with no 32-bit support in hardware</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.160</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.38</li><li>TalkBack (screen reader): update dependencies</li><li>TalkBack (screen reader): remove more unused resources</li><li>TalkBack (screen reader): drop 32-bit OS support</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070900">2024070900</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070900-redfin">2024070900-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070900">2024070900</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070201 release:</p><ul><li>Settings: extend standard fingerprint enrollment stages with proper support for devices with power button fingerprint scanners (Pixel Fold, Pixel Tablet) which is not present in AOSP (Pixel Fold was still usable, but it had become incredibly hard to successfully register new fingerprints on the Pixel Tablet)</li><li>improve warning for 32-bit-only apps by explaining why the warning is shown, how to resolve it for apps that are still developed and that we plan to phase out support for it on 5th/6th generation Pixels where it's still available</li><li>show warning for 32-bit-only apps on each launch instead of only once</li><li>kernel (Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a): disable 32-bit ABI support to substantially decrease kernel size and attack surface and raise mmap_min_addr to the standard 65536 for 64-bit-only ARM</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.158</li><li>adevtool: update file removal for 8th gen Pixels to skip Family Space related files</li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-122">version 122</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.3">version 126.0.6478.122.3</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070201">2024070201</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070201">2024070201</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024070200 release:</p><ul><li>full 2024-07-05 security patch level</li><li>rebased onto AP2A.240705.005 Android Open Source Project release</li><li>avoid skipping toggling USB port after unlock in certain edge cases to make sure devices connected while locked are always detected when unlocking</li><li>fix upstream bug causing first party app stores using the package install dialog to be blocked when the user isn't allowed to install apps from third party sources</li><li>fix notification suppression check in currently unused code to prepare for our per-app clipboard toggle</li><li>adevtool: download and use latest Pixel carrier settings from the API for use by our CarrierConfig2 app instead of using the snapshot included in the latest Pixel stock OS release since it lags months behind</li><li>Settings: fully fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy</li><li>Sandboxed Google Play compatibility layer: stub out reads of hidden system settings in Google's speech services app to avoid uncaught security exceptions</li><li>Sandboxed Google Play compatibility layer: don't allow the Play Store to abort pending package installation to avoid it cancelling install/update attempts after 10 minutes of waiting for requested user approval it hasn't been designed to handle</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.218</li><li>kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.155</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.36</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024070200">2024070200</a></h3><p>This is an early July security update release based on the July 2024 security patch backports. This month's release of the Android Open Source Project and stock Pixel OS will be available later today and we'll quickly release an update based on it following this one.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024070200">2024070200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024062700 release:</p><ul><li>full 2024-07-01 security patch level</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.1">version 126.0.6478.122.1</a></li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.2">version 126.0.6478.122.2</a></li><li>Info: update to <a href="https://github.com/GrapheneOS/Info/releases/tag/3">version 3</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-121">version 121</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024062700">2024062700</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024062700">2024062700</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024062000 release:</p><ul><li>add new GrapheneOS Info app through which you can get information about the latest releases of GrapheneOS, links to our community spaces, and details on how to make donations</li><li>Pixel 8a: add Let's Encrypt roots to Samsung gnssd CA root store for supl.grapheneos.org</li><li>Pixel 8a: configure Samsung gnssd to use TLSv1.2 for SUPL instead of TLSv1.1 (TLSv1.3 would work but the config doesn't offer it)</li><li>Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold: fully remove 32-bit ARM support to significantly reduce build time and update download size with no loss of functionality (7th gen Pixels launched with 32-bit app support disabled after several years of the Play Store blocking uploading 32-bit-only apps or installing them on 64-bit devices, and 8th gen Pixels use 2nd gen ARMv9 cores with no 32-bit support)</li><li>Settings: fix several cases of UI state being lost when resuming activity after configuration changes, etc. for GrapheneOS settings</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.216</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.90</li><li>kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.35</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.0">version 126.0.6478.122.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-120">version 120</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024062000">2024062000</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024062000">2024062000</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061400 release:</p><ul><li>remove our USB peripheral security setting on devices supporting our much better USB-C port mode (Pixel 6 and later)</li><li>extend USB-C port setting to also handle pogo pins on the Pixel Tablet</li><li>kernel (5.10, 5.15, 6.1, 6.6): replace our deny_new_usb feature with a new deny_new_usb2 feature also disabling USB gadgets</li><li>extend USB-C port setting to enable deny_new_usb2 as a second layer of defense disabling new USB connections in the kernel (the existing implementation disables new connections and USB data at a hardware level via the USB controller, which disables more attack surface, but we want to keep around the higher level kernel approach too)</li><li>Files: fix upstream null pointer exception triggered on resuming activity</li><li>Settings: require user authentication for changing auto-reboot, USB peripheral and USB-C port security settings</li><li>Settings: avoid prompting for user authentication when selecting the same value as before for GrapheneOS settings requiring it</li><li>temporarily add back memory tagging exception for Pixel wifi_ext service</li><li>simplify implementation of our auto-reboot feature and properly handle the first lock after the user first sets up a lock method</li><li>avoid resetting USB-C port after first unlock if it was already connected Before First Unlock (fix for regression caused by upstream changes)</li><li>add GrapheneOS Linux kernel port to the 6.6 GKI LTS branch</li><li>kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.215</li><li>kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.87</li><li>kernel (6.1, 6.6): add script for building emulator kernel</li><li>kernel (6.1, 6.6): enable forced module signing for x86_64 (emulator builds)</li><li>System Updater: increase update check interval to 6 hours from 4 hours</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.110.0">version 126.0.6478.110.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-118">version 118</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-119">version 119</a></li><li>fix cast in GrapheneOS package management infrastructure needed for upcoming App Communication Scopes work</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061400">2024061400</a></h3><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061400">2024061400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061300 release:</p><ul><li>revert upstream refactoring of the device association code in Android 14 QPR3 due to it introducing a chain crash bug at boot in edge cases with associated devices such as paired Android Wear devices</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.71.0">version 126.0.6478.71.0</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061300">2024061300</a></h3><p>We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha and Beta testing.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061300">2024061300</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024061200 release:</p><ul><li>fix upstream Android 14 QPR3 regression which breaks updating certain apps with our app repository client</li><li>fix boot-time optimizing apps progress UI with Android 14 QPR3 and enable it again</li><li>fix regression in our Android 14 QPR3 port resulting in PIN scrambling in secondary users being determined by the Owner user setting</li><li>revert upstream Android 14 QPR3 Internet quick tile overhaul since it broke the functionality in secondary users</li><li>temporarily add back disabling memory tagging and hardened_malloc for surfaceflinger since Android 14 QPR3 didn't fix it as expected</li><li>disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release</li><li>add additional null check for eSIM wiping done as part of the duress PIN/password wipe implementation to avoid harmless exception</li><li>Settings: remove blank illustration from "Screen resolution" screen</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.1">version 126.0.6478.50.1</a></li><li>make duress PIN/password tests faster and more reliable</li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024061200">2024061200</a></h3><p>This is the first release of GrapheneOS based on Android 14 QPR3, the 3rd quarterly maintenance/feature release for Android 14.</p><p>We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha testing.</p><p>Pixel 8a is now supported as part of the standard Android releases instead of having a device branch based on Android 14 QPR1. We've had stable releases for it available since May 15th (1 day after launch) based on our last QPR1-based release (2024030300). Pixel 8a users will be getting the GrapheneOS improvements from March, April, May and June along with the Android 14 QPR2 and QPR3 improvements so it's a much larger release for the Pixel 8a.</p><p>Since Android 14 QPR3 is a major release, the end-of-life Pixel 4a (5G) and Pixel 5 receiving extended support releases from GrapheneOS will need to be ported to it with additional work in a future release, which is done as a low priority. Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024061200">2024061200</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)</li></ul><p>Changes since the 2024060500 release:</p><ul><li>full 2024-06-05 security patch level</li><li>rebased onto AP2A.240605.024 Android Open Source Project release, which is the 3rd quarterly maintenance/feature release for Android 14 (QPR3)</li><li>temporarily disable boot-time optimizing apps progress UI due to upstream Android 14 QPR3 regression (our own post-boot background optimizing apps progress notification works fine)</li><li>temporarily enable system crash notifications unconditionally for the initial QPR3-based release</li><li>change default USB-C port mode to "Charging-only when locked" from "Charging-only when locked, except before first unlock"</li><li>stop disabling memory tagging and hardened_malloc for surfaceflinger</li><li>Settings: fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.0">version 126.0.6478.50.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-117">version 117</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024060500">2024060500</a></h3><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060500-redfin">2024060500-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060500">2024060500</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024060400 release:</p><ul><li>Sandboxed Google Play compatibility layer: adjust to DynamiteLoader changes being deployed with a new feature flag in Play services 24.22</li><li>stop treating pressing the spacebar on a physical keyboard as submitting the lockscreen password since it prevents entering passphrases with spaces (upstream Android bug which has existed for around 8.5 years)</li><li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/125.0.6422.165.0">version 125.0.6422.165.0</a></li><li>GmsCompatConfig: update to <a href="https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-116">version 116</a></li></ul></article><article><h3><a href="https://grapheneos.org/releases#2024060400">2024060400</a></h3><p>This is an early June security update release based on the June 2024 security patch backports since this month's release of the Android Open Source Project and stock Pixel OS with Android 14 QPR3 isn't available yet.</p><p>Pixel 4a (5G) and Pixel 5 are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.</p><p>Tags:</p><ul><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060400-redfin">2024060400-redfin</a> (Pixel 4a (5G), Pixel 5)</li><li><a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/2024060400">2024060400</a> (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, emulator, generic, other targets)</li></ul><p>Changes since the 2024053100 release:</p><ul><li>full 2024-06-01 security patch level</li><li>extend the standard wipe-without-reboot implementation beyond wiping the hardware keystores (which prevents recovering any OS data by preventing deriving the key encryption keys) by also wiping the secdiscardable data on the SSD needed to derive key encryption keys, the encrypted storage keys on the SSD and the Weaver slots in the secure element needed to derive per-user key encryption keys via a secure element erase</li><li>kernel (5.10): update to latest GKI LTS branch revision</li><li>ke</li></ul></article></section>